auth_time Claim in an OpenID Connect ID Token
auth_time is the time the end user last authenticated, as seconds since the Unix epoch. It can be far earlier than iat, because a token minted from an existing session records the original login rather than the moment of issue.
At a glance
- Claim
- auth_time
- Defined in
- OpenID Connect Core 1.0 section 2
- Value type
- NumericDate: seconds since 1970-01-01T00:00:00Z
- Required
- Required when the request used max_age or asked for auth_time as an essential claim. Optional otherwise.
- Sample value
- 1735686000, roughly an hour before a token issued at 1735689600
- In the decoder
- Shown under Custom claims as a bare number. Only exp, nbf and iat are rendered as readable local timestamps.
In detail
iat says when the token was built. auth_time says when the person last proved who they were. A single sign on session that lasts a working day can mint dozens of ID tokens, every one with a fresh iat and all of them carrying the same auth_time from the morning's login. Treating iat as a proxy for authentication freshness therefore overstates it, sometimes by hours.
The claim exists so a relying party can demand recency. Sending max_age on the authentication request tells the provider that if the existing session is older than that many seconds it must re-authenticate the user, and it must then include auth_time so the relying party can check the result rather than take it on trust. Step up flows before a sensitive action use exactly this mechanism.
The check is a comparison, not a presence test. Read auth_time, add your maximum acceptable age, and reject the token if the result is in the past, allowing the same small clock leeway you allow on exp. A provider that ignores max_age and returns a stale auth_time is caught by that comparison, which is the whole reason the value is returned instead of a simple confirmation.
The decoder shows auth_time under Custom claims exactly as encoded, which means a ten digit number rather than a date. The human readable timestamp treatment, the countdown and the progress bar apply to exp, nbf and iat only. To read this one as a date, paste the number into the timestamp converter, which also runs entirely in your browser.
Examples
{
"iss": "https://auth.example.com",
"sub": "8f14e45fceea167a5a36dedd4bea2543",
"auth_time": 1735686000,
"iat": 1735689600,
"exp": 1735693200
}The session is an hour old at issue time. A max_age of 300 seconds should have forced a fresh login.
Things that catch people out
- Using iat where auth_time is meant. iat refreshes on every token; auth_time does not move until the person authenticates again.
- Requesting max_age and never comparing auth_time. If the provider does not honour the request, nothing tells you unless you check.
- Expecting the claim to appear by default. Unless max_age was sent or auth_time was asked for as an essential claim, providers are free to leave it out.
Try it: JWT Decoder
Paste a token to decode the header and payload, read the claims and expiry, and verify the signature in your browser. Nothing is uploaded.
JWT Decoder
LOCAL · Browser-OnlyDecode and inspect JSON Web Tokens without sending them to a server
Related JWT claims and algorithms
All jwt claims and algorithms →iat (Issued At) Claim in a JWT
The iat claim records when a JWT was created. What it is good for, why it is not an expiry, and the age and lifetime figures the decoder derives.
acr (Authentication Context Class Reference) Claim
The acr claim states how strongly the user was authenticated. Why its values are provider specific, what the value 0 means, and how the decoder shows it.
amr (Authentication Methods References) Claim
The amr claim lists how the user authenticated. The registered values from RFC 8176, why the list is not proof of strength, and what the decoder shows.
at_hash (Access Token Hash) Claim in an ID Token
The at_hash claim ties an ID token to the access token issued with it. How the left half hash is computed, when it must be checked, and decoder limits.
c_hash (Code Hash) Claim in an ID Token
The c_hash claim binds an ID token to the authorization code returned with it. Where hybrid flows need it, how it is computed, and what the decoder shows.
sid (Session ID) Claim in a JWT
The sid claim identifies the authentication session at the provider. How single logout uses it, why it is not the user identifier, and decoder behaviour.
Tools for this
- JWT Decoder Free online JWT decoder - decode and inspect JSON Web Tokens without sending them to a server
- Timestamp Converter Free online timestamp converter - convert between Unix timestamps and human-readable dates instantly