A token payload is the data section of a security token. It carries claims and token properties that the server uses when authenticating requests. In a JWT, unique_name identifies the user, while nbf, exp, and iat record token timestamps. section 39.5.5
The payload is produced after submitted credentials pass password validation. The server protects it with the configured key, returns the token to the client, and later reads unique_name when a bearer token arrives in the Authorization header. section 39.5.5
A payload commonly contains:
- Additional claims or properties when the token's purpose requires them. section 39.5.5
Payload carried by a JWT
A decoded payload can look like { "unique_name": "bob", "nbf": 1579765454, "exp": 1579851854, "iat": 1579765454 }. The client sends the resulting token as Authorization: Bearer <token>; the server uses unique_name to authenticate the request.
