JWT claims
The key-value pairs in a JWT's payload. RFC 7519 registers standardised short names (3 letters).
Standard claims: iss (issuer), sub (subject — user-id), aud (audience — who the token is meant for), exp (expiry Unix timestamp), iat (issued at), nbf (not before), jti (unique token ID for revocation). OIDC adds email, name, preferred_username. Private claims (custom): use a URI or domain name to avoid collisions (https://your-app.com/role). Always validate aud + exp + the signature — a common miss leads to privilege escalation.