Signed-link token claims
Reference for partner-signed JWT claims and the enclosing JWE.
JWT protected header
| Name | Value |
|---|---|
alg | EdDSA, ES256, or RS256 |
kid | The signing key ID registered with Genesis |
typ | JWT (recommended) |
Claims
| Claim | Required | Meaning |
|---|---|---|
iss | Yes | Exact integration slug |
aud | Yes | genesis-forums |
sub | Yes | Stable external UUID |
jti | Yes | Unique single-use token ID |
iat | Yes | Issued-at NumericDate |
exp | Yes | Expiry NumericDate, no more than 15 minutes after issue |
nbf | No | Not-before NumericDate |
username | No | Proposed username, at most 50 characters |
email | No | Proposed email, at most 320 characters |
destination | No | Safe internal Forum path |
JWE protected header
| Name | Required value |
|---|---|
alg | RSA-OAEP-256 |
enc | A256GCM |
cty | JWT (recommended) |
The plaintext is the complete compact signed JWT, not its decoded payload.
Validation order
Genesis decrypts the JWE, verifies the inner JWT against the registered partner key, validates standard and custom claims, checks replay state, validates proposed fields and destination, then displays the consent screen. Failure at any stage prevents linking.