> For the complete documentation index, see [llms.txt](https://docs.corppass.gov.sg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-legacy/endpoints/token-endpoint/access-token-structure.md).

# Access Token Structure

The Access Token is a signed JWS consumed by Corppass resource servers.

{% hint style="warning" %}
Relying Parties (RPs) **must treat the Access Token as opaque** and **must not** attempt to parse or interpret its content.
{% endhint %}

JWT Payload Example:

```json
{
  "iat": 1716451740,
  "exp": 1716452339,
  "iss": "https://stg-id.corppass.gov.sg",
  "scope": "authinfo tpauthinfo",
  "aud": ["https://stg-id.corppass.gov.sg/authorization-info"],
  "client_id": "97ZZnLxUfzzVz50kfCwB",
  "sub": "s=S1234567P,uuid=0f14a2fc-09c2-4780-95f0-8c28347f2780,u=CP192,c=SG",
  "jti": "vhC0eLzU-ol8IQ0RuFL5f"
}
```

The JWS payload includes the following claims:

<table><thead><tr><th width="124">Claim</th><th width="114">Type</th><th>Description</th></tr></thead><tbody><tr><td>aud</td><td>Array</td><td>The URI of the resource server(s) for which the Access Token is intended. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.3">Section 4.1.3 of RFC 7519</a>.</td></tr><tr><td>iss</td><td>String</td><td>The issuer of the Access Token. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.1">Section 4.1.1 of RFC 7519</a>.</td></tr><tr><td>iat</td><td>Number</td><td>The time at which the Access Token was issued, expressed as a UNIX timestamp. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.6">Section 4.1.6 of RFC 7519</a>.</td></tr><tr><td>exp</td><td>Number</td><td>The expiration time on or after which the Access Token <strong>MUST NOT</strong> be accepted for processing. Defaults to 10 minutes since <code>iat</code>. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.4">Section 4.1.4 of RFC 7519</a>.</td></tr><tr><td>scope</td><td>String</td><td>A space-separated list of scopes granted by the token, which defines the permissions for the resource server.</td></tr><tr><td>sub</td><td>String</td><td>The principal that is the subject of the JWT. It contains a comma-separated list of <code>key=value</code> pairs that uniquely identify the user, which may include multiple alternate identifiers.</td></tr><tr><td>client_id</td><td>String</td><td>The client ID of the Relying Party for which the Access Token is intended.</td></tr><tr><td>jti</td><td>String</td><td>The unique identifier of the token.</td></tr></tbody></table>