Page Comparison

JWT ID. A unique identifier for the token, which can be used to prevent reuse of the token.

See jti claim.

Expiration time on or after which the Access Token MUST NOT be accepted for processing.

Epoc time format.

Identifies the time before which the JWT must not be accepted for processing.

Epoc time format. See nbf claim.

Time at which the JWT was issued.

Epoc time format.

The subject identifier.

A locally unique and never reassigned identifier within the Issuer for the end-user.

Intended to be consumed by the client as a possible end-user reference.

NOTE:

Even if the identifier is "never reassigned" it may still change for the same user!

A user may be reassigned a new sub, but a used sub will never be assigned to a new user.

Hence, do not use this as a user reference over time!

Implementation specific claim denoting the token type.

Not to be used by clients!

Case sensitive string value used to associate a client session with an Access Token, and to mitigate replay attacks.

The value is passed through unmodified from the authentication request to the Access Token.

Implementation specific claim for use with session handling.

Not to be used by clients!

String specifying an Authentication Context Class Reference value that identifies the Authentication Context Class that the authentication performed satisfied.

This can for example be values based on some definition of Level of Assurance (LoA).

List of scopes approved by the OpenID Provider for this Access Token.

Note that the list of scopes might be different from what the client initially requested. Some scopes may not be approved by the OpenID Provider, and some additional scopes may have been added as being configured as default scopes for the client.

JWT ID. A unique identifier for the token, which can be used to prevent reuse of the token.

See jti claim.

Expiration time on or after which the Access Token MUST NOT be accepted for processing.

Epoc time format.

Identifies the time before which the JWT must not be accepted for processing.

Epoc time format. See nbf claim.

Time at which the JWT was issued.

Epoc time format.

The subject identifier.

A locally unique and never reassigned identifier within the Issuer for the client.

Intended to be consumed by a service as a possible client reference.

NOTE:

Even if the identifier is "never reassigned" it may still change for the same client!

A client may be reassigned a new sub, but a used sub will never be assigned to a new client.

Hence, do not use this as a client reference over time!

Implementation specific claim denoting the token type.

Not to be used by clients!

Implementation specific claim for use with session handling.

Not to be used by clients!

String specifying an Authentication Context Class Reference value that identifies the Authentication Context Class that the authentication performed satisfied.

This can for example be values based on some definition of Level of Assurance (LoA).

List of scopes approved by the OpenID Provider for this Access Token.

Note that the list of scopes might be different from what the client initially requested. Some scopes may not be approved by the OpenID Provider and some additional scopes may have been added as being configured as default scopes for the client.