## Documentation Index

Fetch the complete documentation index at: [/docs/llms.txt](/content/docs/llms.txt)

Use this file to discover all available pages before exploring further.

200

```
{
    "iss" : "https://${projectDomain}",
    "sub" : "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
    "aud" : [
        "PROJECT_ID"
    ],
    "client_id": "connected-app-test-d731954d-dab3-4a2b-bdee-07f3ad1be888",
    "exp" : 1738786128,
    "nbf" : 1738782528,
    "iat" : 1738782528,
    "jti" : "LOe49j3s9d9dmacslUvrb15ZIjPbptMm7fS5UlE52JCF",
    "scope" : "openid email profile phone"
}
```

200

An **Access Token** is a credential used to access protected resources. An access token represents an authorization issued to a particular Connected App Client by a Stytch User. Access Tokens are issued by the [**Token Endpoint**](/content/docs/api-reference/b2b/api/connected-apps/exchange-authorization-code/index.html) automatically at the end of every successful OAuth flow. Access Tokens embed the authorization granted to a Connected App Client within the scope field. Stytch supports the standard OpenID scopes: `openid`, `profile`, `email`, `phone`, and `offline_access`. Access tokens granted to Connected App clients are **JWTs (JSON Web Tokens)** signed by your Stytch project’s [**JWKS (JSON Web Key Set)**](/content/docs/api-reference/b2b/api/connected-apps/configuration/get-jwks/index.html) using the RS256 algorithm. They can be validated locally by using a [Stytch Backend SDK](/content/docs/api-reference/b2b/api/connected-apps/methods/authenticate-access-token-local/index.html), or any library that supports the JWT protocol.

### Fields

iss

string

The issuer of the token. By default, this is your project’s Custom Domain, or `stytch.com/${projectId}` if the token was retrieved using the stytch.com domain. See the [Custom Domain](/content/docs/connected-apps/resources/custom-domains/index.html) guide for more information.

sub

string

The subject of the token. This is a unique identifier for the user.

aud

string

The audience (`client_id`) that the token is intended for. Additional custom audiences can be defined for the token by setting the `access_token_custom_audience` parameter on the client object.

exp

number

The expiration time of the token, expressed as a Unix timestamp.

nbf

number

The time before which the JWT must not be accepted for processing, expressed as a Unix timestamp.

iat

number

The time at which the token was issued, expressed as a Unix timestamp.

jti

string

A unique identifier for the JWT.

scope

string

A space separated list of scopes granted to the client. For example, `read:users write:users`.