Describes the list of the fields required to put into the JWT token to create an iFrame session. Algorithm s HS256
| JWT field | Meaning | Format |
|---|---|---|
| iss | The ID of the CAAS Client. This is the identity of the user assigned to your business entity | GUID |
| aud | altery.com | String |
| sub | CustomerId, the id of the customer received via onboarding API | GUID |
| jti | JWT ID, generated id, unique per request | String |
| card_ref | The id of the card - CardIdentity received when creating a card | GUID |
| exp | Expiration time of the token (Unix timestamp). Defines how long the JWT is valid | Integer (Unix timestamp) |
[!WARNING]
Theissclaim must identify the same partner that calls the iframe-session endpoint, and the card referenced bycard_refmust belong to that partner. A request whose token issuer does not match the caller, or whose card is owned by a different account, is rejected with403 Forbidden.