A JWT is a JSON-based access token sent in an HTTP request from an API client to a resource. JWTs are issued by identity providers (for example, Oracle Identity Cloud Service (IDCS), Auth0, Okta). When an API client attempts to access a protected resource, it must include a JWT.