What Are JWT Public Claims?
JWT (JSON Web Token) public claims are standardized fields used to share information between parties. They follow a reserved name format (like iss for issuer) and help define the token's purpose. These claims are part of the JWT payload and help systems verify authenticity and enforce rules.
Common JWT Public Claims
Some widely used public claims include:
- **iss** (Issuer): Identifies the entity that created the token
- **exp** (Expiration Time): Sets when the token becomes invalid
- **sub** (Subject): Identifies the token's primary audience
- **aud** (Audience): Specifies who the token is intended for
- **iat** (Issued At): Records when the token was created
These claims help ensure proper token handling across different services. For example, the exp claim prevents tokens from being used indefinitely, while aud ensures tokens aren't misused between different applications.
Using Public Claims in Authentication
Public claims play a key role in secure API workflows:
1. When a user logs in, the server creates a JWT with claims like sub (user ID) and exp
2. The client stores this token and sends it with API requests
3. Each service checks public claims to verify:
- Is the token expired (exp)?
- Was it issued by a trusted source (iss)?
- Is it intended for our system (aud)?
This standardized approach makes it easy to share authentication data between services while maintaining security controls.
Best Practices for JWT Claims
To use public claims effectively:
- Always validate expiration (exp) and audience (aud) claims
- Don't store sensitive data in public claims
- Combine with private claims for application-specific data
- Use HTTPS to protect tokens during transmission
Avoid creating custom claims for common use cases - the public claims set covers most authentication needs. When you need custom data, use the registered claim names or define private claims with proper namespace prefixes.