OptionalaudAudience.
OptionalexpExpiration time (seconds since epoch).
OptionaliatIssued-at time (seconds since epoch).
OptionalissIssuer.
OptionalscopeSpace- or array-delimited OAuth scopes.
OptionalsubSubject (the principal the token is about).
Standard + custom JWT claims.