What is IAT Claim in JWT?
The **IAT claim** (short for *Issued At*) is a standard field in JSON Web Tokens (JWT) that indicates when the token was created. It's represented by the `iat` key and stores a Unix timestamp showing the token's creation time. This claim helps verify token freshness and prevents replay attacks by setting an expiration baseline.
JWT tokens use numeric date values for time claims. For example: `{"iat": 1698765432}` represents December 1, 2023 at 10:17:12 UTC.
Why IAT Claim Matters
The IAT claim plays three critical roles:
1. **Time-based Expiry** - Works with `exp` (expiration time) claim to set token lifespan
2. **Clock Skew Protection** - Helps detect time discrepancies between systems
3. **Security Enforcement** - Prevents tokens from being used before/after valid periods
When validating JWTs, systems check that:
- Current time is after `iat`
- Current time is before `exp`
- Time difference between `iat` and `exp` is within allowed window
How IAT Works with Other Claims
The IAT claim works alongside these common JWT claims:
| Claim | Purpose | Example Value |
|-------|---------|---------------|
| `iat` | Issued At | 1698765432 |
| `exp` | Expiration Time | 1699024932 |
| `nbf` | Not Before | 1698765432 |
For example, a JWT with `iat: 1698765432` and `exp: 1699024932` is valid for exactly 72 hours.
Validating IAT Claims
To validate the IAT claim:
1. Convert `iat` timestamp to local time
2. Compare with current server time
3. Check if time difference is within allowed clock skew (usually ±5 minutes)
Here's a simple validation check in pseudocode:
if current_time < token.iat - 300: # 5 minute leeway
reject token
elif current_time > token.exp + 300:
reject token
else:
accept token
Common IAT Claim Questions
- **How precise should IAT timestamps be?**
Use whole seconds for consistency across systems
- **Can IAT be used alone for security?**
No - always combine with `exp` and `nbf` claims for full protection
- **What happens if IAT is missing?**
The token should be rejected as incomplete
- **How does IAT handle time zones?**
Always use UTC timestamps to avoid confusion between systems
When implementing JWT validation, make sure your server's clock is properly synchronized with an NTP server to avoid time-related errors. The IAT claim provides crucial context for token lifespan management when used correctly with other time-based claims.