exp

Identifies the party that issued the token, usually the name or URL of the auth server. On verification, check it matches the expected issuer.

Identifies the subject the token is about (typically the user). It must be unique within the issuer's scope.

Indicates the intended recipients of the token. A verifier must confirm it is included in this audience.

The token is not valid before this time (Not Before). Paired with exp it forms a validity window.

The time the token was issued. Useful for computing token age or reissue policies.

A unique identifier for the token. Used to mark tokens as spent to prevent reuse or replay attacks.