JsonWebTokenTypes Class
The registry of typ header values that specifications fix: each is registered with IANA
(or by the body that owns the profile) and required verbatim by its counterparties, so none may
be changed. The registry sits in the JWT core the way JsonWebKeyTypes does for
kty values: every package building on the core shares one copy of the vocabulary instead
of drifting its own.
public static class JsonWebTokenTypesInheritance System.Object → JsonWebTokenTypes
Remarks
A product's own invented values do not belong here. RFC 6838 Section 3.2 gives them the vendor tree ("vnd." names for "media types associated with publicly available products"), and they live beside the product that mints them - combined with this registry through the IsPermitted(string, IReadOnlyList<string>, string[]) overload, so refusal decisions still see both vocabularies.
Fields
JsonWebTokenTypes.AccessToken Field
The "AccessToken" JWT type is used to represent access tokens, typically used for authenticating and authorizing users in APIs.
public const string AccessToken = "at+jwt";Field Value
Remarks
FIXED BY SPECIFICATION - MUST NOT be changed. Registered with IANA as application/at+jwt by
RFC 9068, which requires it verbatim: "JWT access tokens MUST include this media type in the typ header
parameter to explicitly declare that the JWT represents an access token complying with this profile"
(Section 2.1). Every resource server that validates our access tokens rejects any other value, so a
change here is not a rename but a withdrawal from the profile.
JsonWebTokenTypes.ClientAuthentication Field
A JWT used to authenticate a client, per RFC 7523bis (approved, awaiting its number).
public const string ClientAuthentication = "client-authentication+jwt";Field Value
JsonWebTokenTypes.DPoPProof Field
The "DPoP proof" JWT type per RFC 9449 §4.2. The typ header MUST equal this
value so a relying party that trusts the same client across multiple JWT types
(id_token, request_object, DPoP proof) cannot have one type replayed as another
per the RFC 8725 §3.11 token-type confusion guidance.
public const string DPoPProof = "dpop+jwt";Field Value
JsonWebTokenTypes.EntityAttestation Field
An Entity Attestation Token, per RFC 9782.
public const string EntityAttestation = "eat+jwt";Field Value
JsonWebTokenTypes.EntityStatement Field
An OpenID Federation entity statement, registered by the OpenID Foundation.
public const string EntityStatement = "entity-statement+jwt";Field Value
JsonWebTokenTypes.ExplicitRegistrationResponse Field
An OpenID Federation explicit registration response, registered by the OpenID Foundation.
public const string ExplicitRegistrationResponse = "explicit-registration-response+jwt";Field Value
JsonWebTokenTypes.JwkSet Field
A signed JSON Web Key Set, registered by the OpenID Foundation.
public const string JwkSet = "jwk-set+jwt";Field Value
JsonWebTokenTypes.Jwt Field
Standard JSON Web Token type. Per RFC 7519 Section 5.1, this is the recommended value for the 'typ' header parameter.
public const string Jwt = "JWT";Field Value
JsonWebTokenTypes.KeyBinding Field
An SD-JWT key binding token, per RFC 9901.
public const string KeyBinding = "kb+jwt";Field Value
JsonWebTokenTypes.Known Field
Every typ named in this class except Jwt, which says only that a thing is a JWT
and so cannot tell one kind from another.
public static readonly IReadOnlyList<string> Known;Field Value
System.Collections.Generic.IReadOnlyList<System.String>
Remarks
A value belongs here once this class names it, whoever issues it. What decides whether a given one is refused is not membership but the position it turns up in, and that is stated at each call site rather than here - see IsPermitted(string, string[]).
Add a value when this class gains one. Leaving it out is the failure that matters: an omission is a refusal that silently does not happen, and nothing anywhere reports it. Public rather than private, because a product combines this list with its own vendor values and hands the union back through the list-taking IsPermitted(string, IReadOnlyList<string>, string[]) overload.
JsonWebTokenTypes.LogoutToken Field
The "LogoutToken" JWT type is used in the context of OpenID Connect for single logout functionality.
public const string LogoutToken = "logout+jwt";Field Value
Remarks
FIXED BY SPECIFICATION - MUST NOT be changed. Registered with IANA as application/logout+jwt by
the OpenID Foundation and required by OpenID Connect Back-Channel Logout, which the relying parties we
notify implement. A different value would leave every one of them unable to recognise the token.
JsonWebTokenTypes.ProvidedClaims Field
Claims provided to an identity assurance verifier, registered by the OpenID Foundation.
public const string ProvidedClaims = "provided-claims+jwt";Field Value
JsonWebTokenTypes.RequestObject Field
An OAuth 2.0 request object, per RFC 9101.
public const string RequestObject = "oauth-authz-req+jwt";Field Value
JsonWebTokenTypes.ResolveResponse Field
An OpenID Federation resolve response, registered by the OpenID Foundation.
public const string ResolveResponse = "resolve-response+jwt";Field Value
JsonWebTokenTypes.SecurityEvent Field
A Security Event Token, per RFC 8417.
public const string SecurityEvent = "secevent+jwt";Field Value
JsonWebTokenTypes.StatusList Field
A token status list, per the OAuth status list specification (approved, awaiting its number).
public const string StatusList = "statuslist+jwt";Field Value
JsonWebTokenTypes.TokenIntrospection Field
The "token introspection response" JWT type per RFC 9701 §5. The typ header equals this value so a
signed introspection response cannot be replayed as a different JWT type (RFC 8725 §3.11).
public const string TokenIntrospection = "token-introspection+jwt";Field Value
JsonWebTokenTypes.TrustMark Field
An OpenID Federation trust mark, registered by the OpenID Foundation.
public const string TrustMark = "trust-mark+jwt";Field Value
JsonWebTokenTypes.TrustMarkDelegation Field
An OpenID Federation trust mark delegation, registered by the OpenID Foundation.
public const string TrustMarkDelegation = "trust-mark-delegation+jwt";Field Value
JsonWebTokenTypes.TrustMarkStatusResponse Field
An OpenID Federation trust mark status response, registered by the OpenID Foundation.
public const string TrustMarkStatusResponse = "trust-mark-status-response+jwt";Field Value
JsonWebTokenTypes.VerifiableCredential Field
A W3C Verifiable Credential secured as a JWT.
public const string VerifiableCredential = "vc+jwt";Field Value
JsonWebTokenTypes.VerifiablePresentation Field
A W3C Verifiable Presentation secured as a JWT.
public const string VerifiablePresentation = "vp+jwt";Field Value
Methods
JsonWebTokenTypes.IsPermitted(string, string[]) Method
Reports whether a typ is one this position permits, so that a JWT meant for a different purpose
can be refused where it has no business being.
public static bool IsPermitted(string? tokenType, params string[] permittedTypes);Parameters
tokenType System.String
The typ header parameter of the incoming JWT, which may be absent.
permittedTypes System.String[]
The types this position permits. Pass none where the JWT that belongs there carries no typ at
all, as an ID token does - then every type this class names is out of place.
Returns
System.Boolean
true for an absent, generic or unfamiliar value and for any of permittedTypes;
false only for a type this class names that is not among them.
Remarks
This enumerates what to refuse rather than what to accept, which is the opposite of the usual preference, and the reason is that the accepting side cannot be enumerated. RFC 7523bis allows a client authentication JWT to be typed "client-authentication+jwt or another more specific explicit type value defined by a specification profiling this specification", and RFC 9101 Section 4 observes of the request object that "some existing deployments may alternatively be using the type application/jwt". An allow list would refuse conformant senders on both counts, so an absent, generic or unfamiliar value passes untouched and a sender that never heard of explicit typing is unaffected.
What is refused therefore depends on where the question is asked, which is why what belongs is
named by the caller. The alternative - one list of everything a server issues - was too narrow at
half the call sites: a client assertion and a request object are verified with the CLIENT's key, so the
client chooses the typ and can present a JWT it signed for some entirely different purpose.
Refusing by kind is the mutually exclusive validation RFC 8725 Section 3.12 asks for.
JsonWebTokenTypes.IsPermitted(string, IReadOnlyList<string>, string[]) Method
The same refusal-by-kind decision over a caller-supplied vocabulary: a product whose known set is this registry PLUS its own vendor values passes the union here, so its refusals see both.
public static bool IsPermitted(string? tokenType, System.Collections.Generic.IReadOnlyList<string> knownTypes, params string[] permittedTypes);Parameters
tokenType System.String
The typ header parameter of the incoming JWT, which may be absent.
knownTypes System.Collections.Generic.IReadOnlyList<System.String>
Every type the caller can name, this registry's and its own alike.
permittedTypes System.String[]
The types this position permits.
Returns
System.Boolean
true for an absent, generic or unfamiliar value and for any of permittedTypes;
false only for a known type that is not among them.