Hands-On RESTful Web Services with Go - Second Edition

Private claims

Private claims are used to identify one token from another. They can be used for authorization. Authorization is a process of identifying which client made the request. Multi-tenancy refers to the situation of multiple clients accessing an API on a system. The server can set a private claim called username on the payload of the token. Next time, the server can read this payload back and get the username, and then use that username to authorize and customize the API response. It is similar to a cookie but in a different way.

For example, username: Indiana Jones is a private claim in the following payload:

{  "sub": "1234567890",  "username": "Indiana Jones",  "admin": true}

Public claims are similar to private claims, but they ...