Auth0 JWTs - what is in the token and how to verify it
Auth0 issues RS256 access tokens and ID tokens. Learn what each one contains, why you sometimes get an opaque token instead of a JWT, how to verify against Auth0's JWKS, and how to fix the common "invalid audience" and "jwt malformed" errors.
AWS Cognito JWTs - ID token vs access token and how to verify them
Amazon Cognito user pools issue three tokens. Learn what the ID and access tokens contain, how token_use and client_id replace the usual audience check, where the JWKS lives, and how to verify with aws-jwt-verify or any JWT library.
Firebase ID tokens - what they contain and how to verify them on your server
Firebase Authentication issues RS256 ID tokens that expire after one hour. Learn the claims inside, the issuer and audience to check, where Google publishes the signing certificates, how to verify with the Admin SDK or a plain JWT library, and how custom claims work.