# Claims

* Key value items
* Inside the token
* Asserted by the issuer
* Claim truth about the subject
* Can be used for fine grained access control
* Example
  * subject=jacob
    * age=42
    * profession=geek
    * workplace=Google
    * subscription\_level=gold

<figure><img src="https://519089207-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2A0dg9Wy89z8CRkQMup2%2Fuploads%2FwVW5Q7ExCTB2Y0I87Ikf%2F2024-08-09_20-56.png?alt=media&#x26;token=22ca606c-1bc4-4b98-81fa-08684bddbf65" alt=""><figcaption></figcaption></figure>

## The Access token claims

Can be the API for your API

Single source of truth for identity data

Avoid external calls from the APi

Design a common Identity API for your APIs

Can be different depending on the scopes in the token
