Additional application-defined claims
OptionalexpirationExpiration timestamp
Issued-at timestamp, defaults to the event created_at when omitted
Issuer claim, defaults to the signing pubkey when omitted
OptionalnotNot-before timestamp
Subject claim, defaults to the signing pubkey when omitted
Audience claims