UserJwtPayload

UserJwtPayload

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Human-user access token. Issued by /auth/login, /auth/refresh, /auth/sso/exchange, /auth/sso/callback (non-PKCE), etc.

Discriminated by token_type: 'access'. Service tokens (the M2M flow) share the same TokenClaims struct on the Go side but set token_type: 'service' and populate client_id/service_name/scopes instead — see ServiceJwtPayload.

Extends

• BaseJwtClaims.ImpersonationClaims

Properties

app_code?

optional app_code?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

app_id?

optional app_id?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

App scoping (AUDIT 8.3). Downstream services validate claims.app_code === self.app_code so a token minted for app A can never be accepted by app B. Both are absent when AUTH_ALLOW_BASE_USER_LOGIN is set and login carried no app_code.

---

aud?

optional aud?: string | string[]

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Inherited from

BaseJwtClaims.aud

---

auth_provider?

optional auth_provider?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

display_name?

optional display_name?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

email

email: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

exp?

optional exp?: number

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Inherited from

BaseJwtClaims.exp

---

first_name?

optional first_name?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

iat?

optional iat?: number

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Inherited from

BaseJwtClaims.iat

---

imp_email?

optional imp_email?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Inherited from

ImpersonationClaims.imp_email

---

imp_uid?

optional imp_uid?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Inherited from

ImpersonationClaims.imp_uid

---

iss?

optional iss?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Inherited from

BaseJwtClaims.iss

---

jti?

optional jti?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Inherited from

BaseJwtClaims.jti

---

last_name?

optional last_name?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

namespace?

optional namespace?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

User pool / namespace (auth-server migration 017). The home pool the identity belongs to. Absent for the default pool (the server omits it for wire economy). See the auth-server docs/USER_POOLS.md.

---

nbf?

optional nbf?: number

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Inherited from

BaseJwtClaims.nbf

---

org_id?

optional org_id?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Organization context. Nil when the user logged in without org scoping.

---

org_name?

optional org_name?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

org_slug?

optional org_slug?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

permissions

permissions: string[]

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

remember_me?

optional remember_me?: boolean

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

roles

roles: string[]

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

session_id?

optional session_id?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

sub?

optional sub?: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Inherited from

BaseJwtClaims.sub

---

token_type

token_type: "access"

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

---

tv?

optional tv?: number

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

Per-user token-version counter captured at issue time (AUDIT 1.10 / 3.4). The server bumps this on logout-all / role-change; validators reject tokens whose tv is below the current per-user value.

---

uid

uid: string

Defined in: @rw3iss/auth-shared/src/jwt/claims.ts

User id. Matches uid on the wire (Go UserID claim).