[BUG] Preset JWT Payload Claims Aren't Mapped to Standard JWT Fields

Below is an explanation for the behavior you’re seeing. In the JWT node’s current implementation, when you choose to set payload claims with preset fields (using the built-in UI) the node wraps the claims under a "payload" key. For example, you get a structure like this:

JSONCopied
[
  {
    "payload": {
      "audience": "xxxx",
      "expiresIn": 1739158030,
      "issuer": "xxxx",
      "iat": 1739157970
    }
  }
]

However, when the JWT is verified the verification process expects the claims to match the standard field names defined in the JWT specification. That is, instead of a field called "expiresIn" the token should provide an "exp" claim, and similarly for other fields (for instance, "issuer" should be "iss" or "audience" as "aud"). Also, note that these claims (exp, iat, etc.) are meant to be expressed as numeric values representing date/time in seconds since the Unix epoch rather than a duration in seconds.

To ensure proper verification, the payload should follow this format:

JSONCopied
{
  "iss": "https://aifb.ch",
  "aud": "my-api",
  "exp": 1707820800,
  "iat": 1707817200
}

Essentially, if you’re constructing your JWT with the preset fields, you’ll need to make sure that the claims are mapped to standard JWT names. The preset field “expiresIn” ideally should be converted into an “exp” field that holds the expiration timestamp. The default value of 3600 (i.e., 1 hour) is intended to be used as a duration but then added to the issued-at time (iat) to form the correct exp value. In your case, the verification node isn’t interpreting the provided numeric value as a duration because it expects a full timestamp.

If you’re setting up your payload directly via the JSON editor (by enabling “Use JSON to Build Payload”), you have full control and can format the payload with the correct keys (like "exp", "iss", etc.) as shown above.

If this behavior is causing issues in your workflow, you might consider updating your payload structure manually or checking the node’s issue tracker for any updates regarding a mapping fix between the preset field names and the standard JWT claims.

I hope this helps clarify the situation!