#### [Abblix\.Jwt](https://www.abblix.com/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt')

## JsonWebTokenHeader Class

Represents the header part of a JSON Web Token \(JWT\), containing metadata about the token
such as the type and the algorithm used for signing\.

```csharp
public class JsonWebTokenHeader
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebTokenHeader

### Remarks
The JWT header typically specifies the cryptographic operations applied to the JWT
and can also include additional properties defined or required by the application\.
### Constructors

## JsonWebTokenHeader\(JsonObject\) Constructor {#Abblix.Jwt.JsonWebTokenHeader.JsonWebTokenHeader(System.Text.Json.Nodes.JsonObject)}

Represents the header part of a JSON Web Token \(JWT\), containing metadata about the token
such as the type and the algorithm used for signing\.

```csharp
public JsonWebTokenHeader(System.Text.Json.Nodes.JsonObject json);
```
#### Parameters

###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenHeader.JsonWebTokenHeader(System.Text.Json.Nodes.JsonObject).json}

### Remarks
The JWT header typically specifies the cryptographic operations applied to the JWT
and can also include additional properties defined or required by the application\.
### Properties

## JsonWebTokenHeader\.AgreementPartyUInfo Property {#Abblix.Jwt.JsonWebTokenHeader.AgreementPartyUInfo}

The 'apu' header parameter \(RFC 7518 §4\.6\.1\.2\): base64url\-encoded Agreement PartyUInfo
\(producer information\) fed into the Concat KDF during ECDH\-ES key agreement\.

```csharp
public string? AgreementPartyUInfo { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenHeader\.AgreementPartyVInfo Property {#Abblix.Jwt.JsonWebTokenHeader.AgreementPartyVInfo}

The 'apv' header parameter \(RFC 7518 §4\.6\.1\.3\): base64url\-encoded Agreement PartyVInfo
\(recipient information\) fed into the Concat KDF during ECDH\-ES key agreement\.

```csharp
public string? AgreementPartyVInfo { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenHeader\.Algorithm Property {#Abblix.Jwt.JsonWebTokenHeader.Algorithm}

The algorithm used to sign the JWT, indicating how the token is secured\.

```csharp
public string? Algorithm { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
The 'alg' parameter identifies the cryptographic algorithm used to secure the JWT\.
Common algorithms include HS256, RS256, and ES256\. It is crucial for verifying the JWT integrity\.
Per RFC 7515 Section 4\.1\.1, this parameter is REQUIRED\.

## JsonWebTokenHeader\.Certificates Property {#Abblix.Jwt.JsonWebTokenHeader.Certificates}

The 'x5c' \(X\.509 Certificate Chain\) header parameter \(RFC 7515 §4\.1\.6\): an X\.509
certificate chain as a JSON array of base64\-encoded DER certificates, the first being
the leaf\. Returns the raw base64 strings; consumers are responsible for decoding to
`X509Certificate2` and validating the chain per RFC 5280\.

```csharp
public System.Collections.Generic.IReadOnlyList<string>? Certificates { get; set; }
```

#### Property Value
[System\.Collections\.Generic\.IReadOnlyList&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')

#### Exceptions

[System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException')  
Thrown when 'x5c' is present but is not a JSON array of strings\.

## JsonWebTokenHeader\.CertificateSha1Thumbprint Property {#Abblix.Jwt.JsonWebTokenHeader.CertificateSha1Thumbprint}

The 'x5t' \(X\.509 SHA\-1 Thumbprint\) header parameter \(RFC 7515 §4\.1\.7\): base64url\-encoded
SHA\-1 digest of the DER\-encoded leaf certificate\. Per RFC 7515 §10\.11, SHA\-1 is
discouraged because of cryptographic weaknesses \- prefer [CertificateSha256Thumbprint](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader#Abblix.Jwt.JsonWebTokenHeader.CertificateSha256Thumbprint 'Abblix\.Jwt\.JsonWebTokenHeader\.CertificateSha256Thumbprint')
for new deployments\. The library exposes 'x5t' for inspection of legacy producers\.

```csharp
public string? CertificateSha1Thumbprint { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenHeader\.CertificateSha256Thumbprint Property {#Abblix.Jwt.JsonWebTokenHeader.CertificateSha256Thumbprint}

The 'x5t\#S256' \(X\.509 SHA\-256 Thumbprint\) header parameter \(RFC 7515 §4\.1\.8\):
base64url\-encoded SHA\-256 digest of the DER\-encoded leaf certificate\. The C\# member
name strips the '\#' character \(illegal in identifiers\); the JSON literal stays
'x5t\#S256' as defined by the spec\.

```csharp
public string? CertificateSha256Thumbprint { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenHeader\.CertificatesUrl Property {#Abblix.Jwt.JsonWebTokenHeader.CertificatesUrl}

The 'x5u' \(X\.509 URL\) header parameter \(RFC 7515 §4\.1\.5\): a URI referring to an X\.509
public\-key certificate or certificate chain corresponding to the key used for the JWS
signature\. Same caveat as [JwkSetUrl](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader#Abblix.Jwt.JsonWebTokenHeader.JwkSetUrl 'Abblix\.Jwt\.JsonWebTokenHeader\.JwkSetUrl') \- the library does not fetch\.

```csharp
public System.Uri? CertificatesUrl { get; set; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## JsonWebTokenHeader\.Critical Property {#Abblix.Jwt.JsonWebTokenHeader.Critical}

The 'crit' \(Critical\) header parameter \(RFC 7515 §4\.1\.11\): names of JOSE header parameters
that the recipient MUST understand and process\. Returns null when 'crit' is absent\.

```csharp
public System.Collections.Generic.IReadOnlyList<string>? Critical { get; set; }
```

#### Property Value
[System\.Collections\.Generic\.IReadOnlyList&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')

#### Exceptions

[System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException')  
Thrown when 'crit' is present but is not a JSON array of strings\.

## JsonWebTokenHeader\.EncryptionAlgorithm Property {#Abblix.Jwt.JsonWebTokenHeader.EncryptionAlgorithm}

The content encryption algorithm used for JWE \(JSON Web Encryption\)\.

```csharp
public string? EncryptionAlgorithm { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
The 'enc' parameter identifies the content encryption algorithm used to encrypt the plaintext
to produce the JWE ciphertext and authentication tag\. Common algorithms include A128CBC\-HS256,
A192CBC\-HS384, A256CBC\-HS512, A128GCM, A192GCM, and A256GCM\.

## JsonWebTokenHeader\.EphemeralPublicKey Property {#Abblix.Jwt.JsonWebTokenHeader.EphemeralPublicKey}

The 'epk' header parameter \(RFC 7518 §4\.6\.1\.1\): the originator's ephemeral public key for
ECDH\-ES key agreement, carried as a JWK with public members only\. Returns null when absent\.

```csharp
public Abblix.Jwt.JsonWebKey? EphemeralPublicKey { get; set; }
```

#### Property Value
[JsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')

#### Exceptions

[System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException')  
Thrown when 'epk' is present but is not a valid JWK \(e\.g\. unknown 'kty'\)\.

## JsonWebTokenHeader\.Json Property {#Abblix.Jwt.JsonWebTokenHeader.Json}

The underlying mutable JSON object backing the strongly\-typed accessors on this header\.
Use this when reading or writing custom header parameters that are not modeled as properties\.

```csharp
public System.Text.Json.Nodes.JsonObject Json { get; }
```

#### Property Value
[System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')

## JsonWebTokenHeader\.JwkSetUrl Property {#Abblix.Jwt.JsonWebTokenHeader.JwkSetUrl}

The 'jku' \(JWK Set URL\) header parameter \(RFC 7515 §4\.1\.2\): a URI referring to a JSON Web
Key Set whose keys the issuer claims are candidates for verifying the JWS\. The library
only exposes the URI; it does not fetch the URL \- the host is responsible for trust and
transport per RFC 7515 §8 \(TLS with server identity validation per RFC 6125\)\.

```csharp
public System.Uri? JwkSetUrl { get; set; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## JsonWebTokenHeader\.KeyId Property {#Abblix.Jwt.JsonWebTokenHeader.KeyId}

The key ID that indicates which key was used to secure the JWT\.

```csharp
public string? KeyId { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
The 'kid' parameter is a hint indicating which specific key from a JWKS was used to sign the JWT\.
This is particularly useful when the issuer has multiple keys and the verifier needs to
identify the correct key for signature verification\.

## JsonWebTokenHeader\.KeyWrapAuthenticationTag Property {#Abblix.Jwt.JsonWebTokenHeader.KeyWrapAuthenticationTag}

The 'tag' header parameter \(RFC 7518 §4\.7\.1\.2\): base64url\-encoded 128\-bit GCM authentication tag
produced when the CEK is wrapped with AES\-GCM key wrapping \(A128GCMKW/A192GCMKW/A256GCMKW\)\.

```csharp
public string? KeyWrapAuthenticationTag { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenHeader\.KeyWrapInitializationVector Property {#Abblix.Jwt.JsonWebTokenHeader.KeyWrapInitializationVector}

The 'iv' header parameter \(RFC 7518 §4\.7\.1\.1\): base64url\-encoded 96\-bit Initialization Vector
used when the CEK is wrapped with AES\-GCM key wrapping \(A128GCMKW/A192GCMKW/A256GCMKW\)\.

```csharp
public string? KeyWrapInitializationVector { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenHeader\.Pbes2IterationCount Property {#Abblix.Jwt.JsonWebTokenHeader.Pbes2IterationCount}

The 'p2c' header parameter \(RFC 7518 §4\.8\.1\.2\): the PBKDF2 iteration count for PBES2\.
Returns null when absent or when the value is not representable as a positive 32\-bit integer \-
a count beyond int\.MaxValue could never pass the decryptor's denial\-of\-service cap anyway\.

```csharp
public System.Nullable<int> Pbes2IterationCount { get; set; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')

## JsonWebTokenHeader\.Pbes2SaltInput Property {#Abblix.Jwt.JsonWebTokenHeader.Pbes2SaltInput}

The 'p2s' header parameter \(RFC 7518 §4\.8\.1\.1\): the base64url\-encoded PBES2 salt input\.
Per the spec it must decode to at least 8 octets; the PBES2 decryptor enforces that bound\.

```csharp
public string? Pbes2SaltInput { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenHeader\.Type Property {#Abblix.Jwt.JsonWebTokenHeader.Type}

The type of the JWT, typically "JWT" or a similar identifier\.
This field is optional and used to declare the media type of the JWT\.

```csharp
public string? Type { get; set; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
The 'typ' parameter is recommended when the JWT is embedded in places not inherently
carrying this information, helping recipients process the JWT type accordingly\.

## JsonWebTokenHeader\.VerificationKey Property {#Abblix.Jwt.JsonWebTokenHeader.VerificationKey}

The 'jwk' \(JSON Web Key\) header parameter \(RFC 7515 §4\.1\.3\): the public key used to
verify the JWS, embedded directly in the JOSE header as a JWK\. Returns null when
'jwk' is absent\. Trust is the consumer's responsibility \- for example, DPoP \(RFC 9449\)
binds this key to the request via a separate confirmation claim\.

```csharp
public Abblix.Jwt.JsonWebKey? VerificationKey { get; set; }
```

#### Property Value
[JsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')

#### Exceptions

[System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException')  
Thrown when 'jwk' is present but is not a valid JWK \(e\.g\. unknown 'kty'\)\.