# claims

Source: https://startwithidentity.com/glossary/claims/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so their integrity and freshness matter.

Claims are where authentication quietly becomes authorization, and where most token bugs live. A relying party that trusts a `groups` or `roles` claim without verifying the issuer, audience, and signature has an authorization system anyone can forge. Claim freshness is the second trap: a token minted before a user was removed from a group stays valid until it expires, which is why revocation needs short lifetimes or a continuous-evaluation signal.

See also: [JWT](https://startwithidentity.com/glossary/jwt/), [ID token](https://startwithidentity.com/glossary/id-token/), [OpenID Connect](https://startwithidentity.com/standards/openid-connect/), [validate a JWT recipe](https://startwithidentity.com/recipes/validate-a-jwt/)