The iss Claim: Issuer Identity

The iss claim names who signed a token. Without it, any service that holds the same secret can sign tokens that pass verification.

iss stands for issuer. It names the service that created and signed the token.

Only auth-service calls jwt.sign. Every verifier passes issuer: 'auth-service' to jwt.verify. A token with a different iss value fails.

What it prevents, the “same secret, different signer” gap:

  Without iss:                     With iss:
  debug-tool signs a token         debug-tool signs (iss:'debug-tool')
  → lobby-service accepts ✗        → iss != 'auth-service' → reject ✓

If a second service signs tokens with the same secret, only iss stops those tokens from passing verification.

Claim	Question it answers
`iss`	Who created this token?
`aud`	Who is this token for?
`sub`	Who is this token about?

From the audit: Before the audit, auth-service signed tokens without iss. After the fix, iss: 'auth-service' went into shared-contracts.

“iss answers one question: who signed this token? Without it, you know the key matched, but not whether the signer is correct.”

References:

Related: back to the Seven Blind Spots Behind a JWT Audit overview · Six Standard Claims · Access and Refresh Token Rotation

Tags #jwt #security #authentication