← Anatomy of a JWT
Read the registered claims
Learn
The claims
RFC 7519 defines registered claims: short names with agreed meanings.
| Claim | Meaning | Who checks it |
|---|---|---|
iss | issuer: who minted the token | API: "do I trust this issuer?" |
sub | subject: who the token is about | API: identifies the caller |
aud | audience: who the token is for | API: "is this token meant for me?" |
exp | expiry time | API: reject after this moment |
nbf | not before | API: reject before this moment |
iat | issued at | auditing, max-age policies |
jti | unique token ID | revocation lists, replay detection |
Anything else, like name, role or scope here, is a private claim that your
system defines. Times are NumericDate: whole seconds since 1970-01-01 UTC. jq's todate
filter or date -u -d @<seconds> makes them readable.
Notice "name": "Chloé Park". Payloads are UTF-8 JSON, and it's the é (bytes
C3 A9) that produced the _ in the encoded payload.
Your task
Use jq -r on $payload to print the issuer (iss) and audience (aud), then print when the token was issued (iat) and when it expires (exp) as human-readable UTC dates.