Who said it, and who is it for?
03Issuer, subject, and audience describe different roles in a claim.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.1.3 ↗
RFC 7519 · § 4.1.3EXAMPLE
4 / 4
04
Apply recipient checks.
The billing service cannot accept this token under the illustrated audience policy.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
A token for one service is not automatically valid at another.
- When aud is present, a processor that is not an intended audience must reject the JWT.
- aud can be a single string or an array of strings.
- sub must be locally unique within its issuer or globally unique.
The examples simplify the wire representation. Follow the linked specification and application profile for implementation.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy