JWT structure and flow in Rest API - Step-by-Step Execution

Concept Flow - JWT structure and flow

Client sends login request

↓

Server verifies credentials

↓

Server creates JWT

↓

Server sends JWT to client

↓

Client stores JWT

↓

Client sends JWT with API requests

↓

Server verifies JWT

↓

Allow access

This flow shows how a client logs in, receives a JWT, stores it, and uses it for authenticated requests, while the server verifies the token each time.

Execution Sample

Rest API

header = {"alg": "HS256", "typ": "JWT"}
payload = {"user_id": 123, "exp": 1680000000}
token = encode(header, payload, secret)
// Client sends token with requests
// Server decodes and verifies token

This code creates a JWT token with header and payload, then encodes it with a secret key.

Execution Table

Step	Action	Data Involved	Result/Output
1	Client sends login request	Username, Password	Request received by server
2	Server verifies credentials	Username, Password	Credentials valid? Yes
3	Server creates JWT	Header, Payload, Secret	JWT token generated
4	Server sends JWT to client	JWT token	Client receives token
5	Client stores JWT	JWT token	Token saved locally
6	Client sends JWT with API request	JWT token in Authorization header	Request sent to server
7	Server verifies JWT	JWT token, Secret	Token valid? Yes
8	Server allows access	Valid token	Requested data sent
9	Client sends JWT with API request	JWT token in Authorization header	Request sent to server
10	Server verifies JWT	JWT token, Secret	Token valid? No (expired or tampered)
11	Server rejects request	Invalid token	Access denied response sent

💡 Execution stops when server rejects invalid or expired JWT token.

Variable Tracker

Variable	Start	After Step 3	After Step 4	After Step 5	After Step 6	After Step 7	After Step 10
header	{"alg": "HS256", "typ": "JWT"}	{"alg": "HS256", "typ": "JWT"}	{"alg": "HS256", "typ": "JWT"}	{"alg": "HS256", "typ": "JWT"}	{"alg": "HS256", "typ": "JWT"}	{"alg": "HS256", "typ": "JWT"}	{"alg": "HS256", "typ": "JWT"}
payload	{"user_id": 123, "exp": 1680000000}	{"user_id": 123, "exp": 1680000000}	{"user_id": 123, "exp": 1680000000}	{"user_id": 123, "exp": 1680000000}	{"user_id": 123, "exp": 1680000000}	{"user_id": 123, "exp": 1680000000}	{"user_id": 123, "exp": 1680000000}
token	null	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjMsImV4cCI6MTY4MDAwMDAwMH0.signature	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjMsImV4cCI6MTY4MDAwMDAwMH0.signature	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjMsImV4cCI6MTY4MDAwMDAwMH0.signature	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjMsImV4cCI6MTY4MDAwMDAwMH0.signature	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjMsImV4cCI6MTY4MDAwMDAwMH0.signature	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjMsImV4cCI6MTY4MDAwMDAwMH0.signature

Key Moments - 3 Insights

Why does the server reject a request even if the client sends a token?

Because the token might be expired or tampered with, as shown in execution_table step 10 where the server finds the token invalid and rejects the request in step 11.

What is inside the JWT token that allows the server to verify it?

The JWT contains a header and payload signed with a secret. The server uses the secret to verify the signature, as shown in step 3 and step 7 of the execution_table.

Does the client need to send username and password with every request?

No, after login the client sends only the JWT token with requests, as shown in steps 6 and 9, so the server can verify the token without needing credentials again.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the server create the JWT token?

A Step 3

B Step 5

C Step 2

D Step 7

💡 Hint

Check the 'Action' column in execution_table for the step where 'Server creates JWT' happens.

According to variable_tracker, what is the value of 'token' after Step 5?

A null

B Header and payload only

C Encoded JWT string

D Secret key

💡 Hint

Look at the 'token' row under 'After Step 5' column in variable_tracker.

At which step does the server reject the request due to an invalid token?

A Step 8

B Step 11

C Step 10

D Step 9

💡 Hint

Check execution_table for the step where 'Server rejects request' is the result.

Concept Snapshot

JWT Structure and Flow:
- Client logs in with credentials
- Server verifies and creates JWT (header.payload.signature)
- Client stores and sends JWT with requests
- Server verifies JWT signature and expiry
- Valid token grants access; invalid token denies
- JWT allows stateless, secure API authentication

Full Transcript

This visual execution shows how JWT works in a REST API. First, the client sends login info. The server checks it. If correct, the server creates a JWT token with header and payload signed by a secret. The server sends this token to the client. The client saves it and sends it with future requests. The server checks the token each time. If the token is valid, the server allows access. If the token is invalid or expired, the server rejects the request. Variables like header, payload, and token change as the process goes. Key moments include understanding why tokens can be rejected, what is inside a JWT, and that credentials are not sent every time. The quizzes test your understanding of these steps and variable states.