nbf
What this is
nbf (not-before) is the counterpart to exp. Verifiers reject the JWT until the current time is at or after nbf. Use it when a token is issued early but must not work yet (embargoed invites, delayed jobs). Combine with exp so the window is bounded.
FAQ
- Why is a brand-new token 'not yet valid'?
- Clock skew. If the issuer's clock is ahead of yours, nbf is still in the future. Allow 30–60 seconds of leeway, or drop nbf if you do not need it.