Understanding Claims in Session JWT Token

​

What Are JWT Claims?

JWT (JSON Web Token) claims are pieces of information encoded into a JWT, providing details about the user and the session. These claims are used to identify users, authorize actions, and validate sessions.

A typical OTPless JWT token consists of three parts:

1. Header: Metadata about the token (e.g., signing algorithm).
2. Payload: The claims.
3. Signature: Ensures the token has not been tampered with.

​

Decoding an Example JWT

Here’s an example OTPless session JWT:

​

Encoded JWT

eyJraWQiOiJwazAxODMiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiI5MWQzMGMxYjcwZTE0NTI3YjZlODg5ZDhkYTFjZGQxOSIsImlzcyI6Imh0dHBzOi8vb3RwbGVzcy5jb20iLCJuYW1lIjoiTWloaXQgVGhha2thciIsInNlc3Npb25JZCI6IjkxZDMwYzFiNzBlMTQ1MjdiNmU4ODlkOGRhMWNkZDE5IiwiZXhwIjoxNzMzNDc0OTI4LCJpYXQiOjE3MzMzODg1MjgsInVzZXJJZCI6Ik1PLWZmMGUzYjk4NGIzMzQ5MGZhNTI2NjYyYWJhMzVlNjM4IiwiZW1haWwiOiJtaWhpdC50aGFra2FyQG90cGxlc3MuY29tIn0.pdeLlOyAta6wyuXnphKOadKGsgsaUPXDxPmLDRY8llaadIx-hoVjyVjGb7k2hzIIfDlIuN4PdQIr9lPDEWCkf0iIdKzymOUa1vSEi80ky2w6B3hmraVW9NxJpi4tJdhZ0GHJTQPjinTrPLCxSEu-n6pNvgcP2A4e47NZ9tawulkQyCDAeX8cx6PKt6g7LwWW9MU4olqnOoaeBJmsKXYZjvpmEVEifImhL_PCsTkbz4aVAN6YJP-fkY1-f4rHRAqqA7bbjDQF5jdiklFdce7tKQ-vNIVVQlFwaf4bORjkYaFsSfA8LoY20fzjOfpBC0TxrRdnyH6_HHO8nL1jQTxrOQ

​

Decoded Payload

{
  "sub": "91d30c1b70e14527b6e889d8da1cdd19",
  "iss": "https://otpless.com",
  "name": "Mihit Thakkar",
  "sessionId": "91d30c1b70e14527b6e889d8da1cdd19",
  "exp": 1733474928,
  "iat": 1733388528,
  "userId": "MO-ff0e3b984b33490fa526662aba35e638",
  "email": "xxxx@otpless.com",
  "phone": "919999999999"
}

​

Key Claims Explained

1. sub (Subject): Identifies the subject of the token, typically the session ID.
2. iss (Issuer): The entity that issued the token. For OTPless, this is always https://otpless.com.
3. name: The user’s full name.
4. sessionId: The unique identifier for the user session.
5. exp (Expiration Time): The Unix timestamp after which the token is no longer valid.
6. iat (Issued At): The Unix timestamp indicating when the token was issued.
7. userId: A unique identifier for the user in the OTPless system.
8. email: The user’s email address.
9. phone: The user’s phone.

​

How to Validate Claims

To validate a JWT token:

1. Check the iss Claim: Ensure the token was issued by OTPless (https://otpless.com).
2. Verify the Signature: Use the public key associated with kid in the header to ensure the token is not tampered with. You can find the public keys at: https://otpless.com/.well-known/jwks.
3. Check Expiry (exp): Ensure the token has not expired.
4. Confirm Audience (aud): Match the aud with the OTPless App Id.