JWT Claims Cheat Sheet
JWT claims are just keys in the payload object. The IANA registry standardizes the short ones, stick to them where they apply and use custom claims for everything else.
Registered claims (RFC 7519)
iss | Issuer, who created and signed the token (URL, usually) |
sub | Subject, who/what the token is about (user ID) |
aud | Audience, who the token is for (your API) |
exp | Expiration. Unix timestamp, after which the token is invalid |
nbf | Not Before. Unix timestamp, before which the token is invalid |
iat | Issued At. Unix timestamp when the token was created |
jti | JWT ID, unique identifier for this token, useful for revocation lists |
OIDC profile claims
email | User's email address |
email_verified | Whether the email is verified (boolean) |
name | Full display name |
given_name | First name |
family_name | Last name |
picture | URL to profile picture |
preferred_username | Username |
locale | BCP-47 locale tag (e.g. en-US) |
Common header claims
alg | Signing algorithm. HS256, RS256, ES256, etc. |
typ | Token type, usually 'JWT' |
kid | Key ID, which key from the JWKS was used to sign |