Short-lived tokens with enforced expiry

RFC 7519 defines the temporal claims that bound a token's usable life. The "exp" (expiration time) claim identifies the time on or after which the JWT MUST NOT be accepted for processing: the current date/time MUST be before the expiration value, with an optional small leeway — usually no more than a few minutes — for clock skew, and the value MUST be a NumericDate. The "nbf" (not before) claim symmetrically rejects tokens used before their start time, and "iat" (issued at) records issuance time so recipients can determine the token's age; all three are OPTIONAL claims, so a token without "exp" never expires on its own. Always issuing "exp" and keeping the lifetime short — so a leaked or replayed token loses value quickly — is Koskamo editorial guidance, not an RFC mandate; the RFCs specify the validation mechanics but leave lifetime length to the application. Scope: JWT security. Reviewed October 4, 2026.