Authentication & Secrets
JWT
Also: JSON Web Token
A signed token with a header, a payload of claims and a signature, separated by dots.
In more detail
The payload is encoded, not encrypted, so anyone can read it; the signature only proves nobody changed it. A server must verify the signature with the expected algorithm and check expiry and audience before trusting any claim. Issued tokens are hard to revoke, so they are kept short-lived.