#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt')

## JwtClaimTypes Class

Names of the JWT claims and JOSE header parameters used by this library, including the
registered claims from RFC 7519 Section 4\.1, common OpenID Connect claims, and several
extensions \(token exchange, security event tokens, etc\.\)\.
Use these constants whenever reading from or writing to a [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader')
or [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') by raw name\.

```csharp
public static class JwtClaimTypes
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtClaimTypes
### Fields

## JwtClaimTypes\.AccessTokenHash Field {#Abblix.Jwt.JwtClaimTypes.AccessTokenHash}

The 'at\_hash' claim is used for the access token hash value in OpenID Connect\.
It provides validation that the access token is tied to the identity token\.

```csharp
public const string AccessTokenHash = "at_hash";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Algorithm Field {#Abblix.Jwt.JwtClaimTypes.Algorithm}

"alg" header parameter \(RFC 7515 Section 4\.1\.1, RFC 7516 Section 4\.1\.1\): identifies the
signing or key management algorithm\. REQUIRED in both JWS and JWE headers\.

```csharp
public const string Algorithm = "alg";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Audience Field {#Abblix.Jwt.JwtClaimTypes.Audience}

The 'aud' \(audience\) claim identifies the recipients that the JWT is intended for\.

```csharp
public const string Audience = "aud";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.AuthContextClassRef Field {#Abblix.Jwt.JwtClaimTypes.AuthContextClassRef}

The 'acr' \(Authentication Context Class Reference\) claim provides the reference values for the authentication context class\.

```csharp
public const string AuthContextClassRef = "acr";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.AuthenticationMethodReferences Field {#Abblix.Jwt.JwtClaimTypes.AuthenticationMethodReferences}

The 'amr' \(Authentication Methods References\) claim lists the authentication methods used during authentication\.
It typically includes values like 'pwd' \(password\), 'mfa' \(multi\-factor authentication\), or other method identifiers,
and can help relying parties understand the strength and nature of the authentication\.

```csharp
public const string AuthenticationMethodReferences = "amr";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.AuthenticationTime Field {#Abblix.Jwt.JwtClaimTypes.AuthenticationTime}

The 'auth\_time' claim represents the time when the authentication occurred\.
It is expressed as the number of seconds since Unix epoch\.

```csharp
public const string AuthenticationTime = "auth_time";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.ClientId Field {#Abblix.Jwt.JwtClaimTypes.ClientId}

The 'client\_id' claim represents the identifier for the client that requested the authentication\.
Often used in OAuth 2\.0 and OpenID Connect flows\.

```csharp
public const string ClientId = "client_id";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.CodeHash Field {#Abblix.Jwt.JwtClaimTypes.CodeHash}

The 'c\_hash' claim is used for the code hash value in OpenID Connect\.
It is a hash of the authorization code issued by the authorization server\.

```csharp
public const string CodeHash = "c_hash";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.ContentType Field {#Abblix.Jwt.JwtClaimTypes.ContentType}

"cty" header parameter \(RFC 7515 Section 4\.1\.10\): the media type of the JWS payload, used
when the payload itself is a nested JWT or another well\-defined media type\.

```csharp
public const string ContentType = "cty";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Critical Field {#Abblix.Jwt.JwtClaimTypes.Critical}

"crit" header parameter \(RFC 7515 Section 4\.1\.11\): a JSON array of JOSE header parameter
names that the recipient MUST understand and process\. The parameter itself MUST be
understood by JWS implementations, even when no extensions are in use\.

```csharp
public const string Critical = "crit";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.DPoPAccessTokenHash Field {#Abblix.Jwt.JwtClaimTypes.DPoPAccessTokenHash}

The 'ath' \(Access Token Hash\) claim binds a DPoP proof to the access token it
accompanies at a protected resource \(RFC 9449 §4\.2\)\. Base64url\-encoded SHA\-256 of
the access\-token ASCII bytes; present only when an access token is presented\.
Distinct from [AccessTokenHash](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtClaimTypes#Abblix.Jwt.JwtClaimTypes.AccessTokenHash 'Abblix\.Jwt\.JwtClaimTypes\.AccessTokenHash') \(OIDC `at_hash` in id\_tokens\)\.

```csharp
public const string DPoPAccessTokenHash = "ath";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.DPoPHttpMethod Field {#Abblix.Jwt.JwtClaimTypes.DPoPHttpMethod}

The 'htm' \(HTTP Method\) claim binds a DPoP proof to the HTTP method of the request
\(RFC 9449 §4\.2\)\. Compared byte\-exact against the request method\.

```csharp
public const string DPoPHttpMethod = "htm";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.DPoPHttpUri Field {#Abblix.Jwt.JwtClaimTypes.DPoPHttpUri}

The 'htu' \(HTTP URI\) claim binds a DPoP proof to the request target URI
\(RFC 9449 §4\.2\)\. Compared after RFC 3986 §6\.2 canonicalisation\.

```csharp
public const string DPoPHttpUri = "htu";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Email Field {#Abblix.Jwt.JwtClaimTypes.Email}

The 'email' claim represents the user's email address\.

```csharp
public const string Email = "email";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.EmailVerified Field {#Abblix.Jwt.JwtClaimTypes.EmailVerified}

The 'email\_verified' claim is a boolean that is true if the user's email address has been verified; otherwise, it is false\.

```csharp
public const string EmailVerified = "email_verified";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.EncryptionAlgorithm Field {#Abblix.Jwt.JwtClaimTypes.EncryptionAlgorithm}

"enc" header parameter \(RFC 7516 Section 4\.1\.2\): identifies the JWE content encryption
algorithm applied to the payload\.

```csharp
public const string EncryptionAlgorithm = "enc";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Events Field {#Abblix.Jwt.JwtClaimTypes.Events}

The 'events' claim represents the events associated with the authentication\.

```csharp
public const string Events = "events";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.ExpiresAt Field {#Abblix.Jwt.JwtClaimTypes.ExpiresAt}

The 'exp' \(expiration time\) claim identifies the expiration time on or after which the JWT must not be accepted for processing\.
It is expressed as the number of seconds since the Unix epoch\.
This claim is used to define the maximum lifespan of the JWT\.

```csharp
public const string ExpiresAt = "exp";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.GrantId Field {#Abblix.Jwt.JwtClaimTypes.GrantId}

"grant\_id" — Abblix private claim \(RFC 7519 Section 4\.3\) identifying the authorization grant a refresh
token belongs to\. It binds every refresh token derived from one grant into a single lineage \(a "token
family" in RFC 9700 terms\): a first\-issued token starts a new grant, and each rotation carries the same
value forward\. It lets a detected replay revoke the whole family in one registry write\. No IANA\-registered
claim captures per\-grant refresh\-token lineage, and this token is self\-issued and self\-validated, never
shown to third parties\. See RFC 9700 Section 4\.14\.2\.

```csharp
public const string GrantId = "grant_id";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.IdentityProvider Field {#Abblix.Jwt.JwtClaimTypes.IdentityProvider}

The 'idp' claim represents the identity provider that authenticated the end user\.

```csharp
public const string IdentityProvider = "idp";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.IssuedAt Field {#Abblix.Jwt.JwtClaimTypes.IssuedAt}

The 'iat' \(issued at\) claim identifies the time at which the JWT was issued\.
It is expressed as the number of seconds since the Unix epoch\.
This claim can be used to determine the age of the JWT\.

```csharp
public const string IssuedAt = "iat";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Issuer Field {#Abblix.Jwt.JwtClaimTypes.Issuer}

The 'iss' \(issuer\) claim identifies the principal that issued the JWT\.
It is typically a URI identifying the issuer\.

```csharp
public const string Issuer = "iss";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.JsonWebKeyHeader Field {#Abblix.Jwt.JwtClaimTypes.JsonWebKeyHeader}

"jwk" header parameter \(RFC 7515 Section 4\.1\.3\): the public key embedded directly in
the JOSE header as a JWK\.

```csharp
public const string JsonWebKeyHeader = "jwk";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.JwkSetUrl Field {#Abblix.Jwt.JwtClaimTypes.JwkSetUrl}

"jku" header parameter \(RFC 7515 Section 4\.1\.2\): URL referring to a JWK Set whose keys
the issuer claims as candidates for verifying the JWS\.

```csharp
public const string JwkSetUrl = "jku";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.JwtId Field {#Abblix.Jwt.JwtClaimTypes.JwtId}

The 'jti' \(JWT ID\) claim provides a unique identifier for the JWT\.

```csharp
public const string JwtId = "jti";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.KeyId Field {#Abblix.Jwt.JwtClaimTypes.KeyId}

"kid" header parameter \(RFC 7515 Section 4\.1\.4, RFC 7516 Section 4\.1\.6\): selects which
key from a JWK Set produced the JWT, allowing key rotation without ambiguity\.

```csharp
public const string KeyId = "kid";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.KeyWrapAuthenticationTag Field {#Abblix.Jwt.JwtClaimTypes.KeyWrapAuthenticationTag}

"tag" header parameter \(RFC 7518 Section 4\.7\.1\.2\): the base64url\-encoded 128\-bit Authentication
Tag produced when the CEK is wrapped with AES\-GCM key wrapping \(A128GCMKW/A192GCMKW/A256GCMKW\)\.

```csharp
public const string KeyWrapAuthenticationTag = "tag";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.KeyWrapInitializationVector Field {#Abblix.Jwt.JwtClaimTypes.KeyWrapInitializationVector}

"iv" header parameter \(RFC 7518 Section 4\.7\.1\.1\): the base64url\-encoded 96\-bit Initialization
Vector used when the CEK is wrapped with AES\-GCM key wrapping \(A128GCMKW/A192GCMKW/A256GCMKW\)\.

```csharp
public const string KeyWrapInitializationVector = "iv";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Nonce Field {#Abblix.Jwt.JwtClaimTypes.Nonce}

The 'nonce' claim provides a string value used to associate a client session with an ID token\.

```csharp
public const string Nonce = "nonce";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.NotBefore Field {#Abblix.Jwt.JwtClaimTypes.NotBefore}

The 'nbf' \(not before\) claim identifies the time before which the JWT must not be accepted for processing\.
It is expressed as the number of seconds since the Unix epoch\.
This claim is used to define the earliest time at which the JWT is considered valid\.

```csharp
public const string NotBefore = "nbf";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.PhoneNumber Field {#Abblix.Jwt.JwtClaimTypes.PhoneNumber}

The 'phone\_number' claim represents the user's phone number\.

```csharp
public const string PhoneNumber = "phone_number";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.PhoneNumberVerified Field {#Abblix.Jwt.JwtClaimTypes.PhoneNumberVerified}

The 'phone\_number\_verified' claim is a boolean that is true if the user's phone number has been verified; otherwise, it is false\.

```csharp
public const string PhoneNumberVerified = "phone_number_verified";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.RequestedClaims Field {#Abblix.Jwt.JwtClaimTypes.RequestedClaims}

The 'requested\_claims' claim represents the specific claims requested by the client\.

```csharp
public const string RequestedClaims = "requested_claims";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Scope Field {#Abblix.Jwt.JwtClaimTypes.Scope}

The 'scope' claim represents the scope of access requested\.

```csharp
public const string Scope = "scope";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.SessionId Field {#Abblix.Jwt.JwtClaimTypes.SessionId}

The 'sid' \(session ID\) claim identifies the session to which the JWT is linked\.
Useful for maintaining state between the client and the issuer\.

```csharp
public const string SessionId = "sid";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Subject Field {#Abblix.Jwt.JwtClaimTypes.Subject}

The 'sub' \(subject\) claim identifies the principal that is the subject of the JWT\.
Typically used to represent the user or entity the token is about\.

```csharp
public const string Subject = "sub";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.Type Field {#Abblix.Jwt.JwtClaimTypes.Type}

"typ" header parameter \(RFC 7515 Section 4\.1\.9\): the media type of the JWT,
for example "JWT" or "at\+jwt" for OAuth 2\.0 access tokens \(RFC 9068\)\.

```csharp
public const string Type = "typ";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.X509CertificateChain Field {#Abblix.Jwt.JwtClaimTypes.X509CertificateChain}

"x5c" header parameter \(RFC 7515 Section 4\.1\.6\): an X\.509 certificate chain embedded in
the JOSE header as a JSON array of base64\-encoded DER certificates\.

```csharp
public const string X509CertificateChain = "x5c";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.X509Sha1Thumbprint Field {#Abblix.Jwt.JwtClaimTypes.X509Sha1Thumbprint}

"x5t" header parameter \(RFC 7515 Section 4\.1\.7\): base64url\-encoded SHA\-1 thumbprint of
the DER encoding of the corresponding X\.509 certificate\. Discouraged in favour of
[X509Sha256Thumbprint](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtClaimTypes#Abblix.Jwt.JwtClaimTypes.X509Sha256Thumbprint 'Abblix\.Jwt\.JwtClaimTypes\.X509Sha256Thumbprint') per RFC 7515 §10\.11\.

```csharp
public const string X509Sha1Thumbprint = "x5t";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.X509Sha256Thumbprint Field {#Abblix.Jwt.JwtClaimTypes.X509Sha256Thumbprint}

"x5t\#S256" header parameter \(RFC 7515 Section 4\.1\.8\): base64url\-encoded SHA\-256 thumbprint
of the DER encoding of the corresponding X\.509 certificate\.

```csharp
public const string X509Sha256Thumbprint = "x5t#S256";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JwtClaimTypes\.X509Url Field {#Abblix.Jwt.JwtClaimTypes.X509Url}

"x5u" header parameter \(RFC 7515 Section 4\.1\.5\): URL referring to an X\.509 public\-key
certificate or certificate chain corresponding to the key used for the JWS signature\.

```csharp
public const string X509Url = "x5u";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')