From 560c511f81f5fdee48c57c2002ad8b5fa434e0f5 Mon Sep 17 00:00:00 2001 From: Taimoor Zaeem Date: Thu, 13 Feb 2025 01:38:20 +0500 Subject: [PATCH] docs: add missing jwt claims and clock skew (#3908) --- docs/references/auth.rst | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/references/auth.rst b/docs/references/auth.rst index cbfbd522e..93af2bf70 100644 --- a/docs/references/auth.rst +++ b/docs/references/auth.rst @@ -159,7 +159,15 @@ You can specify the literal value as we saw earlier, or reference a filename to JWT Claims Validation ~~~~~~~~~~~~~~~~~~~~~ -PostgREST honors the :code:`exp` claim for token expiration, rejecting expired tokens. +PostgREST honors the following `JWT claims `_: + +- ``exp`` Expiration Time +- ``iat`` Issued At +- ``nbf`` Not Before +- ``aud`` Audience, see :ref:`jwt-aud` + +.. note:: + PostgREST allows for a 30-second clock skew when validating the ``exp`` and ``iat`` claims. In other words, it gives an extra 30 seconds before the token is rejected if there is a slight discrepancy in the timestamps. .. _jwt_role_claim_key_extract: