iat
requiredscope: openid (required)Type: number (Unix timestamp in seconds)
iat (issued at) is the Unix timestamp when the ID Token was issued. Used for token freshness checks and audit logging. The difference between exp and iat is the token's intended lifetime.
Details
The iat claim records when the token was created.
Used for: audit logging (when was this token issued?), freshness checks (reject tokens issued more than N hours ago regardless of exp), and correlation with authentication events.
Max age: OIDC's max_age authorization request parameter requests that the user re-authenticate if their last authentication is older than max_age seconds. The auth_time claim records when authentication occurred. Clients can enforce freshness by checking auth_time is recent enough.
iat vs exp: iat is informational. exp is the enforcement boundary. Both should be validated for audit and freshness purposes.
Example Values
| Label | Value |
|---|---|
| Token issued at | 1721908800 |
| Lifetime (exp-iat) | 3600 seconds (1 hour) |
Validation Rules
MUST be present in every ID Token
Should not be in the future (allow clock skew)
Use with auth_time to enforce session freshness (max_age)