Cybersecurity glossary

What is the Issued At Claim (iat)?

Learn what the JWT issued-at claim (iat) is, how it records mint time, how to use it for freshness and max-age policies, and how it complements exp and nbf validation.

Identity and accessUpdated July 23, 2026
Also known asiat claimJWT issued-atToken issuance time

Definition

The issued-at claim (iat) is a registered JWT claim containing a NumericDate that indicates when the token was created, enabling verifiers to evaluate token age, detect anomalous future issuance times, and apply freshness policies beyond simple expiration.

Why issued-at matters

Expiration answers “is it too late?” Issued-at (iat) answers “when was this born?” That distinction matters for freshness policies, incident response, and detecting tokens that claim impossible issuance times.

In OIDC and OAuth JWT profiles, iat is a standard part of understanding token age—not a decorative timestamp.

Practical uses of iat

Age and freshness policies

Reject tokens older than a maximum age even if exp has not passed.

Clock anomaly detection

Flag tokens with iat far in the future relative to verifier time.

Telemetry and forensics

Correlate auth events with issuance time during investigations.

Session semantics

Complement auth_time or similar claims when evaluating re-authentication.

Validating iat in the verification pipeline

1

Verify signature and algorithm

Establish that claims come from a trusted issuer key.

2

Read NumericDate iat

Parse issuance time in seconds since epoch.

3

Reject impossible futures

Fail tokens whose iat is unreasonably ahead of verifier now.

4

Apply optional max-age

For sensitive operations, require now - iat to be under a policy threshold.

5

Combine with exp and nbf

Ensure the token is currently inside its valid time window.

6

Authorize the request

Only then evaluate subject, audience, and permissions.

Time claims working together

ClaimMeaningTypical check
iatIssued atNot far future; optional max age
nbfNot beforenow >= nbf
expExpirationnow < exp
auth_time (OIDC)When user authenticatedRe-auth freshness for step-up

iat hardening checklist

  • Prefer tokens that include iat from the authorization server.
  • Reject far-future iat values with only minimal skew tolerance.
  • Consider max-age rules for high-risk APIs and admin actions.
  • Keep issuer and verifier clocks synchronized with NTP.
  • Do not let clients supply or alter iat.
  • Log iat alongside request IDs for security analytics.
  • Remember iat complements—never replaces—exp enforcement.
  • Document time-claim policy in API verification standards.

The practical takeaway

The issued-at claim (iat) records when a JWT was minted. Use it for freshness, anomaly detection, and clear lifetime semantics alongside exp and nbf.

Treat impossible issuance times as invalid, and keep access-token ages short so iat and exp together describe a tight trust window.

Related security terms

Frequently asked questions

What is the iat claim in simple terms?

iat is the timestamp of when the token was created. Apps can use it to know how old a token is, not only when it expires.

Is iat the same as exp?

No. iat is birth time; exp is death time. A token can be newly issued with a short exp, or older within a longer lifetime.

Do I have to validate iat?

Many profiles expect iat to be present and not in the far future. Additional max-age checks are a strong practice for sensitive APIs.

What format is iat?

A NumericDate in seconds since the Unix epoch, same family as exp and nbf.

Can iat detect replay by itself?

Not alone. It helps freshness policies and analytics, but replay prevention needs short TTL, binding, or jti tracking.

What if iat is in the future?

Treat large future iat values as invalid—often a clock problem or crafted token. Tiny skew leeway may be acceptable.

Should clients set iat?

No. Only the issuer should mint iat. Clients must not rewrite time claims.

References

Explore authoritative guidance and frameworks related to issued at claim (iat).

Explore every security definition

Return to the glossary to search by term, alias, starting letter, or security category.

Browse glossary