01
Check the time unit
NumericDate values for exp, nbf and iat use Unix seconds. A millisecond timestamp would be a different value, not a more precise JWT field.
Developer reference
JWT claims and OAuth errors
Search a registered claim or an OAuth error code, then compare its response location, fictional example and RFC source.
JWT claims
Matches
exp
Response context: JWT claim · RFC 7519
Meaning: Expiration time as a NumericDate in Unix seconds.
Compare Unix seconds, not milliseconds.
Fictional response example
{ "exp": 1893456000 }Fictional data only; do not use as a live credential.
Search stays in this browser; source links open only when chosen.
Category
1 of 23 entries
RFC 7519 / 6749 / 6750Checked 23 Sep 2026
JWT claims tell you who issued a token, whom it targets and when it can be used. This compact index lets you inspect the registered fields without pasting a credential.
OAuth error codes belong to different response locations. Read the endpoint beside each example, then use a separate debugger if you need to inspect a real request.
Why use this JWT claims reference
Why use this JWT claims reference
Meaning without a token
JWT claims such as exp are shown with a fixed Unix-seconds example and a direct RFC definition, so a decoded payload is never mistaken for proof of validity.
One error, different places
An OAuth invalid_request can arrive in a redirect, JSON body or Bearer challenge. The reference keeps those shapes apart instead of offering one vague diagnosis.
Read the protocol context
02
Find the response location
For an OAuth error, choose authorization redirect, token JSON or Bearer resource response before applying the description to your log.
03
Follow the fixed source
Open the cited RFC section and check your provider documentation; use a dedicated debugger to inspect an actual token or request.
Fields, codes and examples
Seven registered fields
The seven RFC 7519 registered JWT claims each have a fictional field example and their own normative anchor.
Errors by endpoint
Authorization and token endpoint errors from RFC 6749 remain separate, even when they share an error string.
Bearer challenge context
RFC 6750 resource errors show the WWW-Authenticate header and suggested HTTP status.
Limits of a reference
- No authentication verdict
- This JWT claims page does not accept a token, verify a signature or decide whether a session is valid.
- Fixed standards baseline
- The list covers RFC 7519, RFC 6749 and RFC 6750. It does not automatically include OIDC, vendor errors or later registry additions.
- Human text is not a code
- OAuth error_description is optional developer guidance; branch on error and endpoint, not a provider’s wording.
- No credential input
- Do not paste a real JWT, signing key or authorization code here, including through a URL parameter. This page only searches fixed reference data.
- No network probe
- Search never contacts an identity provider or transfers a query into another tool. Open a linked debugger yourself if an actual request needs inspection.
- Keep error context
- The same invalid_request code can mean different response locations; invalid_token and insufficient_scope also have different Bearer status guidance.
- No live expiry badge
- NumericDate examples use Unix seconds. A fixed example cannot reveal whether your current session or an unseen token has expired.
JWT claims and OAuth questions
What do iss and aud mean in a JWT?
iss names the issuer; aud names the intended recipient. A server must validate both in its own token-processing context.
Is exp required in every JWT?
No. RFC 7519 registers exp, but which claims an application requires depends on its profile and policy.
What is the difference between invalid_grant and invalid_client?
invalid_client means client authentication failed; invalid_grant concerns the authorization grant or refresh token.
Does error_description have a standard format?
No. error_description is optional human-readable help, and its wording can vary across providers.
Can a decoded JWT prove a token is valid?
No. Decoding only reveals data; signature, issuer, audience, time and application policy still need real validation.
Missing an entry or found an error?
Look up JWT claims now
Start with exp or an OAuth error, read the endpoint and open the normative source before handling a live credential.