Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions docs/usage.rst
Original file line number Diff line number Diff line change
Expand Up @@ -352,6 +352,23 @@ Issued At Claim (iat)
>>> token = jwt.encode({"iat": 1371720939}, "secret")
>>> token = jwt.encode({"iat": datetime.datetime.now(tz=timezone.utc)}, "secret")

The `iat` claim also supports the leeway feature similar to the `exp` and `nbf` claims.
This allows you to validate an "issued at" time that is slightly in the future. Using
leeway with the iat claim can be particularly helpful in scenarios where clock
synchronization between the token issuer and the validator is imprecise.

.. code-block:: pycon

>>> import time, datetime
>>> from datetime import timezone
>>> payload = {
... "iat": datetime.datetime.now(tz=timezone.utc) + datetime.timedelta(seconds=3)
... }
>>> token = jwt.encode(payload, "secret")
>>> # JWT was issued in the future (due to clock skew)
>>> # But with some leeway, it will still validate
>>> decoded = jwt.decode(token, "secret", leeway=5, algorithms=["HS256"])

Subject Claim (sub)
~~~~~~~~~~~~~~~~~~~

Expand Down
4 changes: 2 additions & 2 deletions jwt/api_jwt.py
Original file line number Diff line number Diff line change
Expand Up @@ -211,7 +211,7 @@ def decode_complete(
:type audience: str or typing.Iterable[str] or None
:param issuer: optional, the value for ``verify_iss`` check
:type issuer: str or typing.Container[str] or None
:param leeway: a time margin in seconds for the expiration check
:param leeway: a time margin in seconds for time-based claims (exp, nbf, iat) to account for clock skew
:type leeway: float or datetime.timedelta
:rtype: dict[str, typing.Any]
:returns: Decoded JWT with the JOSE Header on the key ``header``, the JWS
Expand Down Expand Up @@ -335,7 +335,7 @@ def decode(
:type subject: str or None
:param issuer: optional, the value for ``verify_iss`` check
:type issuer: str or typing.Container[str] or None
:param leeway: a time margin in seconds for the expiration check
:param leeway: a time margin in seconds for time-based claims (exp, nbf, iat) to account for clock skew
:type leeway: float or datetime.timedelta
:rtype: dict[str, typing.Any]
:returns: the JWT claims
Expand Down