Guide Updated

JWT iss Claim (Issuer)

The JWT iss (issuer) claim identifies who issued the token. Learn the iss validation rule, why a valid signature does not prove the issuer, and Node.js/Python code to validate iss on every verify call.

The `iss` (issuer) claim identifies the principal that issued the JWT. For most systems this is the URL of the authorization server: for example `https://auth.example.com`. It is one of the seven registered claims defined in RFC 7519 §4.1.1.

Format and values

A case-sensitive string. The RFC does not require a URL, but convention and security practice both strongly prefer one: URLs are globally unique, human-readable, and match the patterns used by JWKS endpoints and OpenID Connect discovery documents.

Validation rule

Your verifier must compare `iss` against a hardcoded allowlist of expected issuers. Never accept a token without checking `iss`, and never build the allowlist dynamically from the token payload itself. If you accept tokens from multiple identity providers (Auth0 + an internal server), pass an array of allowed issuers to your verification call.

Common mistakes

  • Skipping iss validation because the signature already proves origin. It does not: a valid signature proves the token was signed with the right key, not that it was issued by the system you intended to trust. Key rotation, shared keys across environments, and multi-issuer systems all break that assumption.
  • Building the expected issuer from request headers or user input. The expected issuer must be hardcoded server-side.
  • Accepting any issuer whose signing key you trust. If you share one HMAC secret across services, any of them can mint tokens your verifier accepts.

Code examples

Validate iss (Node.js: jsonwebtoken)

Validate iss (Node.js: jsonwebtoken) 
jwt.verify(token, publicKey, {
  algorithms: ["RS256"],
  issuer: "https://auth.example.com",   // exact string match
  audience: "https://api.example.com",
});

// Multiple allowed issuers
jwt.verify(token, publicKey, {
  algorithms: ["RS256"],
  issuer: ["https://auth.example.com", "https://partner-idp.example.com"],
});

Validate iss (Python: PyJWT)

Validate iss (Python: PyJWT) 
payload = jwt.decode(
    token,
    public_key,
    algorithms=["RS256"],
    issuer="https://auth.example.com",
    audience="https://api.example.com",
)

Frequently asked questions

  • What is the iss claim in a JWT?

    iss (issuer) is an RFC 7519 registered claim that identifies the principal that issued the JWT. It is typically the URL of the authorization server, e.g. https://auth.example.com. The verifier compares iss against a hardcoded allowlist of expected issuers and rejects tokens from issuers it does not trust.

  • Why validate iss if the signature already verifies?

    A valid signature proves the token was signed with the correct private key. It does not prove the token was issued by the system you intended to accept tokens from. If you rotate keys, share keys across environments, or accept tokens from multiple identity providers, signature validity alone lets the wrong issuer's tokens through. Always validate iss explicitly with a hardcoded expected value.

  • Can a JWT have multiple issuers?

    No. The iss claim is a single string, not an array. A given JWT is issued by exactly one issuer. If your verifier needs to accept tokens from multiple issuers (e.g. Auth0 and an internal IdP), pass an array of allowed issuers to your verify call: the library checks whether the token's single iss matches any entry in your array.

Related