jti
What this is
jti is a unique identifier for this JWT. Store seen jti values (with exp as TTL) to reject replays of one-time tokens. Password-reset and step-up tokens should always carry jti.
FAQ
- Is jti a substitute for short exp?
- No. Revocation lists grow. Prefer short lifetimes; use jti for tokens that must be single-use.