JWT Token Decoration — Enriching JWTs with Additional Context from External Sources

In this tutorial, you will learn about JWT Token Decoration. We cover key concepts, practical examples, and best practices to help you master this topic.

JWT token decoration enriches tokens with additional claims from external sources during issuance, adding user profile data, computed permissions, and contextual metadata that resource servers need.

flowchart LR
    A["Authentication Event"] --> B["Base JWT Claims"]
    B --> C["Decoration Pipeline"]
    D["User Profile Service"] --> C
    E["Permission Service"] --> C
    F["Context Service"] --> C
    C --> G["Enriched JWT"]
    G --> H["sub, roles, permissions"]
    G --> I["department, tenant_id"]
    G --> J["computed access level"]

What's Next

Combine decoration with {{< ilink "JWT" "JWT Claims Mapping" }} for external identity sources, and review {{< ilink "JWT" "JWT Claims" }} for claim design.