Building Enterprise JavaScript Applications

Asymmetric signature generation

Asymmetric signature generation utilizes a pair of mathematically-related public and private keys. They are related so that information encrypted by one key can only be decrypted using the other key.

In the context of JWTs, you can encrypt the header/claim set using the private key to produce a digital signature, which gets attached to the base-64 encoded header/claim set to produce a complete JWT. We would also make the public key public so consumers of the JWT can decrypt it.

Since the public key can be publicly shared, the issuer (who generates the JWT) and the consumer of the token (who validates it) can be different entities, as they don't need to share the same key.

Examples of asymmetric signature generation ...