RFC 7515 §4.1.4 leaves the format open; common choices are random strings, dates or the JWK thumbprint (RFC 7638), which ties the identifier to the key material. A kid is a hint for key selection, not a security claim: the verifier must still check that the selected key belongs to the expected issuer and is valid for the expected algorithm.
Because it comes from the unverified token, kid is untrusted input. Implementations have been exploited when they used it as a file path or in an SQL query to load keys; treat it as an opaque lookup key into a fixed set.