Cybersecurity glossary
What is the Issued At Claim (iat)?
Learn what the JWT issued-at claim (iat) is, how it records mint time, how to use it for freshness and max-age policies, and how it complements exp and nbf validation.
Definition
The issued-at claim (iat) is a registered JWT claim containing a NumericDate that indicates when the token was created, enabling verifiers to evaluate token age, detect anomalous future issuance times, and apply freshness policies beyond simple expiration.
Why issued-at matters
Expiration answers “is it too late?” Issued-at (iat) answers “when was this born?” That distinction matters for freshness policies, incident response, and detecting tokens that claim impossible issuance times.
In OIDC and OAuth JWT profiles, iat is a standard part of understanding token age—not a decorative timestamp.
Practical uses of iat
Age and freshness policies
Reject tokens older than a maximum age even if exp has not passed.
Clock anomaly detection
Flag tokens with iat far in the future relative to verifier time.
Telemetry and forensics
Correlate auth events with issuance time during investigations.
Session semantics
Complement auth_time or similar claims when evaluating re-authentication.
Validating iat in the verification pipeline
Verify signature and algorithm
Establish that claims come from a trusted issuer key.
Read NumericDate iat
Parse issuance time in seconds since epoch.
Reject impossible futures
Fail tokens whose iat is unreasonably ahead of verifier now.
Apply optional max-age
For sensitive operations, require now - iat to be under a policy threshold.
Combine with exp and nbf
Ensure the token is currently inside its valid time window.
Authorize the request
Only then evaluate subject, audience, and permissions.
Time claims working together
| Claim | Meaning | Typical check |
|---|---|---|
| iat | Issued at | Not far future; optional max age |
| nbf | Not before | now >= nbf |
| exp | Expiration | now < exp |
| auth_time (OIDC) | When user authenticated | Re-auth freshness for step-up |
iat hardening checklist
- Prefer tokens that include iat from the authorization server.
- Reject far-future iat values with only minimal skew tolerance.
- Consider max-age rules for high-risk APIs and admin actions.
- Keep issuer and verifier clocks synchronized with NTP.
- Do not let clients supply or alter iat.
- Log iat alongside request IDs for security analytics.
- Remember iat complements—never replaces—exp enforcement.
- Document time-claim policy in API verification standards.
The practical takeaway
The issued-at claim (iat) records when a JWT was minted. Use it for freshness, anomaly detection, and clear lifetime semantics alongside exp and nbf.
Treat impossible issuance times as invalid, and keep access-token ages short so iat and exp together describe a tight trust window.
Related security terms
Expiration Claim (exp)
Defines when the token must stop being accepted.
Not Before Claim (nbf)
Defines the earliest time a token may be used.
JWT Claim
Overview of registered and custom JWT claims.
JWT Token Replay
Why understanding token age helps bound reuse risk.
Access Token
Credential whose issuance time is commonly recorded in iat.
Frequently asked questions
What is the iat claim in simple terms?
iat is the timestamp of when the token was created. Apps can use it to know how old a token is, not only when it expires.
Is iat the same as exp?
No. iat is birth time; exp is death time. A token can be newly issued with a short exp, or older within a longer lifetime.
Do I have to validate iat?
Many profiles expect iat to be present and not in the far future. Additional max-age checks are a strong practice for sensitive APIs.
What format is iat?
A NumericDate in seconds since the Unix epoch, same family as exp and nbf.
Can iat detect replay by itself?
Not alone. It helps freshness policies and analytics, but replay prevention needs short TTL, binding, or jti tracking.
What if iat is in the future?
Treat large future iat values as invalid—often a clock problem or crafted token. Tiny skew leeway may be acceptable.
Should clients set iat?
No. Only the issuer should mint iat. Clients must not rewrite time claims.
References
Explore authoritative guidance and frameworks related to issued at claim (iat).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.