# JWTForge Documentation

> JWTForge: A JWT Vending Service for Testing, Fuzzing, and Security Research of OAuth2/OIDC Implementations.

Use these links for agent-friendly access to JWTForge guides, token endpoint examples, testing modes, attack scenarios, CLI usage, and API reference material.

## Table of Contents

- [Overview](https://jwtforge.dev/docs/intro.md): JWTForge overview for generating JWT tokens with OAuth2/OIDC claims, structured payloads, fuzzing modes, and security testing scenarios.
- [Legacy Flat JSON](https://jwtforge.dev/docs/token-endpoint/legacy-flat-json.md): Backward-compatible JWTForge flat JSON request format for top-level claims and legacy header controls.
- [Signatures](https://jwtforge.dev/docs/token-endpoint/signatures.md): Configure JWTForge token signatures, including normal signing, unsigned tokens, literal signatures, and vulnerability-oriented signature behavior.
- [Structured JSON](https://jwtforge.dev/docs/token-endpoint/structured-json.md): Use JWTForge structured JSON requests with explicit JWT header, body, and signature objects for token generation and security testing.
- [Fake Mode](https://jwtforge.dev/docs/modes/fake.md): Generate realistic OAuth2/OIDC test JWTs with Faker-backed claims for integration tests and local development.
- [Fuzz Mode](https://jwtforge.dev/docs/modes/fuzz.md): Use JWTForge fuzz mode to randomly mutate selected JWT body claims and supported header fields for robustness testing.
- [Grammar Mode](https://jwtforge.dev/docs/modes/grammar.md): Use deterministic JWTForge grammar templates to test valid, edge-case, vulnerable, injection, and type-variation values.
- [Malicious Mode](https://jwtforge.dev/docs/modes/malicious.md): Generate JWTs with malicious claim and header payloads for SQL injection, XSS, traversal, and downstream input handling tests.
- [Security Testing Modes](https://jwtforge.dev/docs/modes/overview.md): Compare JWTForge fake, fuzz, malicious, and grammar modes for OAuth2/OIDC integration, robustness, and security testing.
- [alg none](https://jwtforge.dev/docs/attacks/alg-none.md): Generate unsigned JWTs and alg none variants to test algorithm allowlist enforcement in JWT consumers.
- [Embedded JWK](https://jwtforge.dev/docs/attacks/embedded-jwk.md): Generate JWTs with embedded jwk header objects to test whether consumers incorrectly trust token-provided keys.
- [jku Injection](https://jwtforge.dev/docs/attacks/jku-injection.md): Generate JWTs with attacker-controlled jku header URLs to test JWKS URL allowlist and trust enforcement.
- [kid Injection](https://jwtforge.dev/docs/attacks/kid-injection.md): Generate JWTs with malicious kid header values for key lookup, path traversal, and injection testing.
- [RS/HS Confusion](https://jwtforge.dev/docs/attacks/rs-hs-confusion.md): Test RS256 to HS256 algorithm confusion handling with JWTForge vulnerability presets.
- [Evaluation](https://jwtforge.dev/docs/evaluation.md): JWTForge evaluation scenarios for integration testing, fuzzing, algorithm confusion, injection discovery, grammar testing, and OAuth2 flows.
- [CLI](https://jwtforge.dev/docs/cli.md): Install and use the JWTForge CLI locally and in CI/CD pipelines with GitHub Actions, Newman, and Postman examples.
- [OpenAPI Pen Test Generator](https://jwtforge.dev/docs/openapi-pen-test-generator.md): Generate or directly run authentication, authorization, and known JWT vulnerability tests from an OpenAPI specification.
- [Header Fields](https://jwtforge.dev/docs/reference/header-fields.md): Reference for JWTForge supported and rejected structured JWT header fields, including alg, typ, cty, kid, jku, jwk, and crit.
- [OIDC/OAuth2 Claims](https://jwtforge.dev/docs/reference/oidc-oauth2-claims.md): Reference for JWTForge standard JWT, OIDC, OAuth2, and custom claim support in structured JSON payloads.
- [OIDC Scopes](https://jwtforge.dev/docs/reference/oidc-scopes.md): Reference for OIDC scope-derived JWT claims generated by JWTForge in fake mode.
- [OpenAPI](https://jwtforge.dev/docs/reference/openapi.md): JWTForge OpenAPI and Swagger reference URLs for trying the token endpoint and inspecting the API contract.
- [Local Development](https://jwtforge.dev/docs/development.md): Run JWTForge locally with Wrangler on port 8787 and Docusaurus docs on port 3000.