Interface: TokenClaims

Access tokens are short-lived JWTs the tenant mints locally with its api_secret; a signaling node verifies the HMAC and does no database read and no callback to the tenant.

The alternative is a blocking HTTP call to an external auth service on every socket connection, where an outage stops all new calls. Local minting removes the latency, the failure mode and the coupling at once, and it is also what makes guests free: the tenant decides what identity to put in the token.

Properties

Property	Type	Description
exp	number	-
grants	Grants	-
iss	string	The api_key. How we find the secret.
jti	string	Replay guard, remembered until exp.
meta?	Record<string, unknown>	-
name?	string	-
nbf	number	-
ref?	string	external_ref. Optional, and a guest has none.
sub	string	The identity: opaque, tenant-scoped, never resolved by us.