Claim
A claim is an assertion or formal demand concerning a subject, fact, right, or loss.
ASP.NET Core in Action, 3e
A claim is a statement about an authenticated subject, represented as a type and value, that can support authorization decisions.
- How it is used
- Uses claims to describe the current user and supply information checked by authorization policies.
- How deep it goes
- Defines the type-and-value model, then works through adding, reading, and requiring claims; defers the administrative UI for changing existing users.
- Examples
- Uses a registration-time FullName claim and an airport boarding-pass policy to show display and access-control uses.
- What you can do after
- Apply it via ASP.NET Core Identity and authorization policies to add user claims, read them, and protect Razor Pages.
Secure APIs
A token claim is a named statement or attribute encoded in a security token, such as a user's role or permission.
- How it is used
- Carries identity, access, lifecycle, role, permission, and scope information through JWT payloads for authentication and authorization decisions.
- How deep it goes
- Explains claims from JWT payload meaning through registered and custom forms and request authorization, while deferring broader RBAC detail.
- Examples
- Uses registered JWT payloads, permissions arrays, admin endpoints, OIDC identity claims, and PyJWT validation examples.
- What you can do after
- Apply claims via PyJWT by validating tokens and checking roles, permissions, or scopes before protected API operations.
Building Web APIs with ASP.NET Core
A claim is a statement about an authenticated user or principal, represented as typed identity data and optionally carrying a value.
- How it is used
- Carries authenticated-user information in JWTs for authorization checks on API requests.
- How deep it goes
- Works through name and role claim creation, then outlines a mobile-phone policy without implementing its required registration and login changes.
- Examples
- Uses a username claim, per-role claims, and a proposed policy requiring both Moderator and mobile-phone claims.
- What you can do after
- Apply it via ASP.NET Core Identity and authorization policies to place role claims in JWTs and specify claim requirements.
Read how Building Web APIs with ASP.NET Core explains claim →
Effective Platform Engineering
A claim is an assertion about an authenticated entity or its permissions conveyed as identity data or in a token.
- How it is used
- Conveys team membership in identity data so platform services can authorize access to team resources.
- How deep it goes
- Explains where a team-membership claim comes from and how it enters a JWT, without detailing claim-format internals.
- Examples
- Uses a GitHub-backed CLI device-authorization flow and an Auth0 configuration exercise to illustrate a team-list claim.
- What you can do after
- Operate/configure an IDP integration that places GitHub team membership in a verifiable token for platform access.
Authorization in Action
A claim is a statement about an entity, such as an identity attribute, conveyed by an identity or authorization system.
- How it is used
- Uses claims to identify requesters, scope identities, and supply attributes for authorization decisions.
- How deep it goes
- Explains claim sources, verification, normalization, and policy evaluation, stopping short of defining a universal claim schema.
- Examples
- Uses OIDC tokens, employment credentials, employer and certification attributes, device posture signals, and tenant-scoped subject identifiers.
- What you can do after
- Apply claims by verifying their sources, mapping them to attributes, and evaluating them in authorization policies.
Spring Security in Action, Second Edition
A claim is a named assertion about a subject or other token property carried in a JSON Web Token.
- How it is used
- Carries application-specific values from an authorization server to a resource server for authentication and authorization decisions.
- How deep it goes
- Explains creation, JWT decoding, authentication conversion, and framework configuration, stopping short of detailed claim-setting business logic.
- Examples
- Uses a priority claim set to HIGH, decoded JWT JSON, a custom authentication class, and a /demo response.
- What you can do after
- Apply it via Spring Security to carry token data into authentication and use that data in authorization rules.
Read how Spring Security in Action, Second Edition explains claim →
.NET in Action, Second Edition
A claim is a named assertion about a subject or token context represented as a property in a security token.
- How it is used
- Uses claims to identify token context and enforce authorization decisions in a protected web service.
- How deep it goes
- Defines JWT payload claims and demonstrates lookup in an authorization handler, stopping short of token issuance or validation internals.
- Examples
- Uses aud, iss, nbf, iat, exp, sub, and preferred_username, then reads preferred_username during custom authorization.
- What you can do after
- Apply claims via ASP.NET Core authorization handlers to restrict an operation to a matching authenticated identity.
Related concepts
- JSON Web Tokenpart of · A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
- API keypart of · An API key is a credential used to identify or authorize a client accessing an application programming interface.
- AddClaimAsyncused by · AddClaimAsync is an ASP.NET Core Identity operation that asynchronously adds a claim to a user account.
- policy engineused by · A policy engine is a software component that evaluates policies against requests, resources, actions, or other inputs and produces decisions or enforcement outcomes.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.