iat
What this is
iat records issuance time. It is not an expiry. Refresh-token rotation, maximum token age, and 'issued before password change' checks all read iat. Display it next to exp so you can see lifetime at a glance.
FAQ
- Can iat be in the future?
- A few seconds of skew is normal. Minutes in the future usually means the issuer clock is wrong or the payload was hand-edited.