Additional claims
OptionalaudToken audience
OptionalemailEmail address
OptionalexpExpiration time (seconds since epoch)
Optionalfamily_Family/last name
Optionalgiven_Given/first name
OptionaliatIssued at time (seconds since epoch)
OptionalissToken issuer
OptionalnameFull name
OptionalnbfNot before time (seconds since epoch)
Optionalpreferred_Preferred username
OptionalsubSubject - unique identifier for the user
JWT payload structure based on standard OIDC claims