Quiz Entry - updated: 2026.10.22
Which claims does an ID token contain, and what does each one mean?
iss (issuer = the OP), sub (the user's subject ID), aud (audience = the RP's client ID), exp and iat (expiry and issue time = validity), auth_time (time of authentication), acr (quality or policy of the authentication) and nonce (from the request).
{
"iss": "https://server.example.com",
"sub": "24400320",
"aud": "s6BhdRkqt3",
"nonce": "n-0S6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970,
"auth_time": 1311280969,
"acr": "urn:mace:incommon:iap:silver"
}
| Claim | Meaning | Why the RP cares |
|---|---|---|
iss |
Issuer: the OP's identifier | Must match the provider the RP trusts. |
sub |
Subject: a stable, unique user ID at that issuer | The key for the user account at the RP; iss + sub together identify a user. |
aud |
Audience: the RP's client ID | A token meant for another app must be rejected. |
exp / iat |
Expiry and issued-at times | Defines the token's validity window. |
auth_time |
When the user actually authenticated | Lets the RP demand a recent login (with max_age). |
acr |
Authentication context class reference: the quality or policy of the authentication | Lets the RP require, say, a level with a second factor. |
nonce |
Value from the authentication request | Binds the token to the RP's session. |
Times are NumericDate values: seconds (not milliseconds) since 1970-01-01 UTC. Use sub, never the email address, as the account key: emails can change and be reassigned, sub does not.
Go deeper:
OpenID Connect Core 1.0: ID Token — the definition of every ID token claim, including amrandazp.- RFC 7519, Section 4.1: Registered Claim Names — the general JWT claims
iss,sub,aud,exp,iatand the NumericDate format.