The bearer token sent with the request; the proof carries its hash (ath), so it works for that token only.
HTTP method of the protected request (htm).
OptionalNowSigning time (iat), epoch seconds. Defaults to now.
Full URL of the protected request (htu).
What one proof is made for.