Only the required members are hashed, in lexicographic order, with no whitespace: crv, kty, x, y for EC keys; e, kty, n for RSA; crv, kty, x for OKP keys (RFC 8037 §2). Optional members such as kid, alg and use are excluded, so the same key always has the same thumbprint. RFC 9278 defines a URI form, urn:ietf:params:oauth:jwk-thumbprint:sha-256:….
Uses: ACME key authorizations (token.thumbprint), DPoP-bound access tokens (cnf.jkt, RFC 9449), SD-JWT VC holder binding, OpenID self-issued providers and kid values. A thumbprint differs from an SPKI fingerprint of the same key because it hashes a different encoding.