For example, if our server wishes to grant a user with the email e@ma.il permission to delete its own profile for one day (25 October 2017), then we may issue a JWT with a payload that looks like this:
{ "jti": "a8f0c4e8e", "iss": "hobnob.social", "sub": "e@ma.il", "nbf": 1508886000, "exp": 1508972400, "iat": 1508274036, "social.hobnob.permissions": { "profile": { "delete": ["e@ma.il"] } }}
The iss, sub, and aud claims must be of type StringOrURI. This means that they can be any arbitrary string, but if they include a colon (:), they must be a valid URI.
