pub struct JwtClaims {Show 14 fields
pub sub: Option<String>,
pub iss: Option<String>,
pub aud: Audience,
pub exp: Option<i64>,
pub iat: Option<i64>,
pub nbf: Option<i64>,
pub jti: Option<String>,
pub scope: Option<String>,
pub scp: Option<Vec<String>>,
pub permissions: Option<Vec<String>>,
pub email: Option<Value>,
pub email_verified: Option<bool>,
pub name: Option<Value>,
pub extra: HashMap<String, Value>,
}Expand description
Standard JWT claims for validation.
Fields§
§sub: Option<String>Subject (user ID)
iss: Option<String>Issuer
aud: AudienceAudience (can be string or array)
exp: Option<i64>Expiration time (Unix timestamp)
iat: Option<i64>Issued at (Unix timestamp)
nbf: Option<i64>Not before (Unix timestamp)
jti: Option<String>JWT ID — unique identifier for this token.
Used by the replay cache to detect reuse of a stolen token.
scope: Option<String>Scope (space-separated string, common in Auth0/Okta)
scp: Option<Vec<String>>Scopes (array, common in some providers)
permissions: Option<Vec<String>>Permissions (array, common in Auth0)
email: Option<Value>Email claim (may be a flat string or a nested object).
email_verified: Option<bool>Email verified
name: Option<Value>Name claim (may be a flat string or a nested object).
extra: HashMap<String, Value>Arbitrary extra claims not captured by named fields above.
Captures custom OIDC claims such as "email", "tenant_id", or
namespaced claims like "https://myapp.com/role" that are not part of
the standard JWT claim set. Used by GET /auth/me to reflect a
configurable subset of the token’s claims to the frontend.