Audiences
Confirmation claim with DPoP thumbprint
Expiration time (Unix epoch seconds)
Issued-at time (Unix epoch seconds)
Issuer
JWT ID
Optional space-separated scopes (per OAuth2)
Subject