JWT Cheatsheet

Issuer — identifies the principal that issued the JWT

Subject — identifies the principal that is the subject of the JWT

Audience — identifies the recipients the JWT is intended for

Expiration Time — time after which the JWT must not be accepted (Unix timestamp)

Not Before — time before which the JWT must not be accepted (Unix timestamp)

Issued At — time at which the JWT was issued (Unix timestamp)

JWT ID — unique identifier for the JWT, used to prevent replay attacks

Full name of the user (OpenID Connect)

Email address of the user (OpenID Connect)

Custom claim for user roles (not standard, but common)

OAuth 2.0 scopes granted to the token

Token type (header claim)

Algorithm used to sign the token (header claim)

Key ID — hint for which key was used to sign (header claim)