Token claim
A token claim is an assertion carried in a security token about an entity, an authentication event, or the token itself.
Reading an assertion
A JSON Web Token represents claims as name-and-value pairs. Familiar examples include iss for the issuer, aud for the audience, and exp for the expiration time. Other claims describe the subject or authentication context. Their meaning depends on the token type, issuer, and protocol.
Decoding lets you read a token. Validation tells the receiving service whether to trust it for a particular purpose. You need both: readable JSON is not proof of authenticity, and a valid identity claim does not grant every permission.
A claim describes the token, not the outcome
An audience identifier tells you where the token is intended to be used. An expiration claim gives its expiry time. Neither tells you that the receiving service accepted it or that someone downloaded a file. For the outcome, look at the service’s request and audit records.
Interpreting and validating claims
Identify whether the token is an ID token, an access token, or another defined type before interpreting its claims. Use the issuer’s documentation for custom fields. Do not assume a claim name has identical meaning across products.
For validation, use the applicable protocol’s requirements for issuer, audience, cryptographic protection, time limits, and other required claims. Then check how the application uses those validated claims to decide what the caller can do. Keep raw tokens out of shared reports; use redacted fields and correlated event references instead.