exp
requiredscope: openid (required)Type: number (Unix timestamp in seconds)
exp (expiration time) is the Unix timestamp after which the ID Token MUST NOT be accepted. Clients MUST verify the current time is before exp. ID Tokens are typically valid for 1 hour. Always validate exp – accepting expired tokens is a security vulnerability.
Details
The exp claim limits the lifetime of an ID Token. Accepting expired tokens allows replay attacks.
Clock skew: clients should allow a small clock skew tolerance (typically 60 seconds) to account for differences between client and server clocks. Rejecting tokens that expired 5 seconds ago due to clock differences is a poor user experience.
Token lifetime: ID Tokens are typically short-lived (1 hour or less). Access tokens may be shorter (15–60 minutes). Refresh tokens are longer-lived.
Use exp for caching: if you cache the result of token verification, invalidate the cache no later than exp. Never cache a token verification result beyond exp.
Never override exp in validation logic: 'this is an internal service so we don't need to validate expiry' is a security anti-pattern. Always validate exp.
Example Values
| Label | Value |
|---|---|
| 1 hour from issue | 1721912400 |
| ISO 8601 equivalent | "2026-07-25T11:00:00Z" |
Validation Rules
MUST be present in every ID Token
Current time MUST be before exp (allow ≤60s clock skew)
Never skip exp validation in any environment
Use exp to set cache TTL for verified token results