Standard claims and what they are for

JWT Authentication Course · lesson 2 of 13 · 4 min read

Seven registered claims carry the security meaning. The rest is yours.

Open this lesson in the learning hub

Key points

  • sub - who the token is about. iss - who issued it. aud - who it is FOR.
  • exp - expiry, nbf - not valid before, iat - issued at. All are epoch seconds, not milliseconds.
  • jti - a unique id, which is what makes a denylist of individual tokens possible.
  • Validating aud matters: a token minted for another API of the same issuer must be rejected.
  • Custom claims are fine, but every one adds bytes to every request - keep the token small.

Validate iss AND aud AND exp. A valid signature only proves who signed it, not who it is for.

Three parts, two dots HS256 vs RS256

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the JWT Authentication Course course, and every lesson in it is listed on the JWT Authentication Course contents page.