Building RESTful Web services with Go

Private claims

Private claims are the names used to identify one token from another. It can be used for authorization. Authorization is a process of identifying which client made the request. Multi-tenancy is having multiple clients in a system. The server can set a private claim called username on the payload of the token. Next time, the server can read this payload back and get the username, and then use that username to authorize and customize the API response.

"username": "Indiana Jones" is the private claim on the preceding sample payload. Public claims are the ones similar to private claims, but they should be registered with the IANA JSON Web Token Registry to make it as a standard. We limit the use of these.

A signature can be created ...