Token issuer
A token issuer is the entity that creates a security token and makes the assertions it contains.
Who is making the assertion?
A JSON Web Token can carry an iss claim identifying its issuer. The subject claim commonly identifies the user or application the token is about. The audience identifies the intended recipient.
Reading the issuer name is only the start. The application must verify that the token came from an issuer it trusts, using the checks required by the protocol. A familiar URL in decoded JSON is not enough.
Match the issuer to the signing key
For a signed JWT, checking the signature and reading iss are not separate trust decisions. RFC 8725 requires the application to establish that the key used for the cryptographic operation belongs to that issuer. A token signed by another provider does not become acceptable because it contains a familiar user name.
Configure which issuers the application accepts, then apply the audience, lifetime, token-purpose, and other checks required for that token type.
For Microsoft Entra applications using tenant-independent metadata, Microsoft documents additional issuer, tenant, and signing-key checks. A shared sign-in hostname does not tell you that the token belongs to the tenant you intended to trust. Use maintained identity libraries and the provider’s documented configuration instead of building a trust decision from a decoded display name.