Tools

JWT Claims Reference

Standard JWT claims defined in RFC 7519 and OpenID Connect. Search by claim key, name, or description.

20 claims

ClaimNameDescriptionExample
issIssuerIdentifies the principal that issued the JWT"iss": "https://auth.example.com"
subSubjectIdentifies the principal that is the subject of the JWT"sub": "user-1234"
audAudienceRecipients that the JWT is intended for"aud": ["https://api.example.com"]
expExpiration TimeTime after which the JWT must not be accepted (Unix timestamp)"exp": 1735689600
nbfNot BeforeTime before which the JWT must not be accepted"nbf": 1735603200
iatIssued AtTime at which the JWT was issued"iat": 1735603200
jtiJWT IDUnique identifier for the JWT, used to prevent replay"jti": "550e8400-e29b-41d4-a716-446655440000"
nameFull NameEnd-user full name"name": "John Doe"
given_nameGiven NameGiven name(s) or first name(s)"given_name": "John"
family_nameFamily NameSurname(s) or last name(s)"family_name": "Doe"
emailEmailEnd-user email address"email": "[email protected]"
email_verifiedEmail VerifiedWhether the email has been verified"email_verified": true
phone_numberPhone NumberEnd-user phone number in E.164 format"phone_number": "+1 (425) 555-1212"
addressAddressEnd-user postal address"address": { "country": "US" }
birthdateBirthdateEnd-user birthday in ISO 8601 format"birthdate": "1990-12-25"
rolesRolesApplication roles assigned to the user (custom)"roles": ["admin", "user"]
scopeScopeOAuth 2.0 scopes (space-separated)"scope": "read:profile write:posts"
azpAuthorized PartyParty to which the ID token was issued"azp": "client-app-id"
nonceNonceString to associate a client session with an ID token"nonce": "n-0S6_WzA2Mj"
at_hashAccess Token HashHash of the access token"at_hash": "MTIzNDU2Nzg5MDEyMzQ1Ng"
Share

marduc812

2026