> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# JWT Structure

> Claims and structure of SIS-issued JWTs for identity verification

When you exchange a signed <Tooltip headline="Stamped Mandate" tip="A signed authorisation a user grants for specific scoped actions — delivered on the wire as a PINT." cta="Glossary →" href="/glossary">Stamped Mandate</Tooltip> via the [token service](/identity/token-exchange), the SIS returns a JWT (JSON Web Token) that third-party services can independently verify. This page documents the JWT's claims and structure.

<Snippet file="product-term-disambiguation.mdx" />

A Stamped Mandate is delivered over the API as a `PINT` (header `x-sumvin-pint-token`); the JWT claims below — including `pint_uri` and `pint_signature` — reference that underlying PINT directly.

## Claims

```json theme={null}
{
  "iss": "https://sis.sumvin.com",
  "sub": "sr:us:person:safe:0xE23c9A70BC749EBddd8c78a864fd911D04E9e992",
  "aud": "partner-x.example.com",
  "jti": "jwt-001-abc-def",
  "iat": 1739999000,
  "exp": 1740000000,
  "wallet": "0xE23c9A70BC749EBddd8c78a864fd911D04E9e992",
  "kyc_status": "verified",
  "scopes": ["sr:us:pint:identity:proof_of_personhood", "sr:us:pint:personalization:read"],
  "pint_uri": "sr:us:pint:abc123",
  "signer_type": "user",
  "verification_tier": "standard"
}
```

### Standard JWT Claims

| Claim | Description                                                                                                                         |
| ----- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `iss` | Issuer. Always `"https://sis.sumvin.com"`                                                                                           |
| `sub` | Subject. The user's [SRI](/identity/sri)                                                                                            |
| `aud` | Audience. The registered identifier of the target third-party service. Verifiers **must** confirm this matches their own identifier |
| `jti` | JWT ID. Unique identifier for this specific token. Used for per-JWT revocation tracking                                             |
| `iat` | Issued At. Unix timestamp of when the JWT was created                                                                               |
| `exp` | Expiration. Unix timestamp after which the JWT is invalid. Mirrors the source PINT's `expiresAt`                                    |

### Sumvin-Specific Claims

| Claim               | Description                                                                             |
| ------------------- | --------------------------------------------------------------------------------------- |
| `wallet`            | The user's Safe Smart Account address                                                   |
| `kyc_status`        | User's KYC verification status (e.g., `"verified"`)                                     |
| `scopes`            | Array of authorised [scopes](/identity/scopes)                                          |
| `pint_uri`          | [SRI](/identity/sri) of the source PINT                                                 |
| `signer_type`       | Who signed the PINT: `"user"` or `"agent"`                                              |
| `verification_tier` | `"standard"` or `"enhanced"` — determines how the verifier must validate the credential |

### Enhanced Tier Claims

When the verification tier is `"enhanced"` (triggered by `sr:us:pint:spend:execute` scope), the JWT includes an additional claim:

| Claim            | Description                                                                                                                                             |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `pint_signature` | The original EIP-712 signature from the PINT. Signals that the verifier must also have received the PINT signature and payload as separate HTTP headers |

## Signing Algorithm

SIS signs JWTs using **ES256** (ECDSA with P-256 curve). The public keys for signature verification are published at the [<Tooltip headline="JWKS" tip="JSON Web Key Set — the public-key document used to validate PINT JWTs." cta="Glossary →" href="/glossary">JWKS</Tooltip> endpoint](/merchant/jwks).

## Key Design Points

**Audience scoping.** Each JWT is bound to a specific audience. A single Stamped Mandate can produce multiple JWTs with different `aud` values — one per service provider in a purchase flow. Verifiers must always check that `aud` matches their own registered identifier.

**Expiry mirrors the mandate.** The JWT's `exp` always equals the source PINT's `expiresAt`. A JWT cannot outlive the Stamped Mandate it was issued for.

**Active revocation.** Even if a JWT hasn't expired, the source Stamped Mandate may have been revoked. Verifiers should call the [revocation check endpoint](/merchant/revocation) to confirm the mandate is still valid.

**Per-JWT tracking.** The `jti` claim uniquely identifies each issued JWT. When a Stamped Mandate is revoked, all JWTs issued against it are invalidated.

## Verifying a JWT

If you are a merchant or service provider receiving this JWT, see the [Verifier Guide](/merchant/verify-jwt) for step-by-step verification instructions.