JWT Claims Explained: The Complete Reference for Standard and Custom Claims

• **iss (Issuer)**: Case-sensitive string or URI identifying who created the token. • **sub (Subject)**: The principal being asserted (e.g., user ID `usr_123`). Must be locally or globally unique. • **aud (Audience)**: The intended consumer. Can be a string or array of strings. Verifiers must reject tokens if they are not in the aud list. • **exp (Expiration Time)**: Integer Unix timestamp (seconds). Token is invalid after this instant. • **nbf (Not Before)**: Integer Unix timestamp. Token cannot be accepted before this instant. • **iat (Issued At)**: Integer Unix timestamp recording token creation time. • **jti (JWT ID)**: Unique identifier for the token, used to track token revocation or prevent replay attacks.