From 716c5ea3f3c488b7cdb83d03cf38f0710c6e434b Mon Sep 17 00:00:00 2001
From: Taimoor Zaeem <mtaimoorzaeem@gmail.com>
Date: Thu, 13 Feb 2025 01:38:20 +0500
Subject: [PATCH] docs: add missing jwt claims and clock skew (#3908)

---
 docs/references/auth.rst | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/docs/references/auth.rst b/docs/references/auth.rst
index 3e7428f2e..004fd4e86 100644
--- a/docs/references/auth.rst
+++ b/docs/references/auth.rst
@@ -165,7 +165,15 @@ You can specify the literal value as we saw earlier, or reference a filename to
 JWT Claims Validation
 ~~~~~~~~~~~~~~~~~~~~~
 
-PostgREST honors the :code:`exp` claim for token expiration, rejecting expired tokens.
+PostgREST honors the following `JWT claims <https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4>`_:
+
+- ``exp`` Expiration Time
+- ``iat`` Issued At
+- ``nbf`` Not Before
+- ``aud`` Audience, see :ref:`jwt-aud`
+
+.. note::
+  PostgREST allows for a 30-second clock skew when validating the ``exp`` and ``iat`` claims. In other words, it gives an extra 30 seconds before the token is rejected if there is a slight discrepancy in the timestamps.
 
 JWT Security
 ~~~~~~~~~~~~