Skip to content
ecdsa.com
JOSE, JWK and COSE

JOSE header parameters for JWS and JWE

Registered JWS and JWE header parameters such as alg, kid, typ, crit, jwk and x5c, with what each one means, where it is registered and the defining document.

35 of 35 shown

JOSE header parameters · 35 entries

Registered JWS and JWE header parameters.

NameDescriptionRegistered forReferences
algAlgorithmJWE, JWSRFC 7515, Section 4.1.1RFC 7516, Section 4.1.1
apuAgreement PartyUInfoJWERFC 7518, Section 4.6.1.2
apvAgreement PartyVInfoJWERFC 7518, Section 4.6.1.3
audAudienceJWERFC 7519, Section 4.1.3
b64Base64url-Encode PayloadJWSRFC 7797, Section 3
client_idThis header contains a Client Identifier. A Client Identifier is used in OAuth to identify a certain client. It is defined in [RFC 6749, Section 2.2].JWSRFC 6749
critCriticalJWE, JWSRFC 7515, Section 4.1.11RFC 7516, Section 4.1.13
ctyContent TypeJWE, JWSRFC 7515, Section 4.1.10RFC 7516, Section 4.1.12
ekA base64url-encoded encapsulated secret, as defined in [draft-ietf-hpke-hpke-03, Section 5]JWERFC-ietf-jose-hpke-encrypt-22, Section 4.1
encEncryption AlgorithmJWERFC 7516, Section 4.1.2
epkEphemeral Public KeyJWERFC 7518, Section 4.6.1.1
iheSSIdThe iheSSId header parameter's value shall specify the SubmissionSet.uniqueId as per [https://profiles.ihe.net/ITI/TF/Volume3/ch-4.2.html#4.2.3.3.12].JWSprofiles.ihe.net/ITI/DSGj/Volume3/ch-5.10.html#5.10
issIssuerJWERFC 7519, Section 4.1.1
ivInitialization VectorJWERFC 7518, Section 4.7.1.1
jkuJWK Set URLJWE, JWSRFC 7515, Section 4.1.2RFC 7516, Section 4.1.4
jwkJSON Web KeyJWE, JWSRFC 7515, Section 4.1.3RFC 7516, Section 4.1.5
jwtThis header contains a JWT. Processing rules MAY depend on the typ header value of the respective JWT.JWSOpenID for Verifiable Presentations 1.0, Section 12
kidKey IDJWE, JWSRFC 7515, Section 4.1.4RFC 7516, Section 4.1.6
nonceNonceJWE, JWSRFC 8555, Section 6.5.2
p2cPBES2 CountJWERFC 7518, Section 4.8.1.2
p2sPBES2 Salt InputJWERFC 7518, Section 4.8.1.1
peer_trust_chainOpenID Federation Peer Trust ChainJWSOpenID Federation 1.0, Section 4.4
pptPASSporT extension identifierJWSRFC 8225, Section 8.1
psk_idA base64url-encoded key identifier (kid) for the pre-shared key, as defined in [draft-ietf-hpke-hpke-03, Section 5.1.2]JWERFC-ietf-jose-hpke-encrypt-22, Section 4
subSubjectJWERFC 7519, Section 4.1.2
svtSignature Validation TokenJWSRFC 9321
tagAuthentication TagJWERFC 7518, Section 4.7.1.2
trust_chainOpenID Federation Trust ChainJWSOpenID Federation 1.0, Section 4.3
typTypeJWE, JWSRFC 7515, Section 4.1.9RFC 7516, Section 4.1.11
urlURLJWE, JWSRFC 8555, Section 6.4.1
x5cX.509 Certificate ChainJWE, JWSRFC 7515, Section 4.1.6RFC 7516, Section 4.1.8
x5tX.509 Certificate SHA-1 ThumbprintJWE, JWSRFC 7515, Section 4.1.7RFC 7516, Section 4.1.9
x5t#S256X.509 Certificate SHA-256 ThumbprintJWE, JWSRFC 7515, Section 4.1.8RFC 7516, Section 4.1.10
x5uX.509 URLJWE, JWSRFC 7515, Section 4.1.5RFC 7516, Section 4.1.7
zipCompression AlgorithmJWERFC 7516, Section 4.1.3

Source: JSON Object Signing and Encryption (JOSE) (IANA), retrieved 2026-10-20. Data license: CC0-1.0. JSON Web Signature and Encryption Header Parameters

All registries