How do I revoke or invalidate a JWT?

Because JWTs are stateless, you cannot 'delete' them from the server. This is their main drawback. To revoke them, you must wait for them to expire, OR you must build a database 'blacklist' of revoked tokens (which defeats the purpose of being stateless). This is why JWTs should have very short expiration times (e.g., 15 minutes).

What does the 'sub' claim mean?

In the JWT specification, `sub` stands for 'subject'. It is the standard key used to identify who the token refers to. You typically store the username, email, or user UUID inside the `sub` claim.

🚀 LEVEL UP TO SENIOR:Unlock 500+ Advanced Practical Challenges & Exercises.

🎓 COURSERA PARTNER:Earn professional Google, Meta, and IBM certificates to supercharge your resume.

Tutorials

HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

⚡ Total XP: 0|💻 fastapimasterclass XP: 0

JSON Web Tokens (JWT)

Master the architecture of stateless authentication. Learn how to securely encode JSON Web Tokens (JWT), verify cryptographic signatures, handle expiration errors, and extract trusted payload data.

LOADING ENGINE...