Understanding the ID token

In the previous section, you received a token response, including an ID token from Keycloak, but we didn’t take a good look at what’s inside the ID token.

The ID token is by default a signed JSON Web Token (JWT), which follows this format:

<Header>.<Payload>.<Signature>

The header and the payload are Base64 URL-encoded JSON documents.

If you take a look at the Token Response in the playground application, you can see the ID token in its encoded format. An example of the encoded ID token is also shown in the following screenshot from the playground application:

Figure 4.7: Encoded ID token

Under the ID Token section, you will see the decoded token broken into three parts. The header tells you what algorithm is used, the type of the payload, and the key ID of the key that was used to sign the token.

An example of a decoded ID Token is shown in the following screenshot from the playground application...