From d3a35b910e3ba7bb91447ef3f5eb9cfeefa65eec Mon Sep 17 00:00:00 2001 From: Vishal Katyal Date: Fri, 14 Aug 2026 18:57:11 -0400 Subject: [PATCH] docs(identity-linking): repair the garbled JWT grant single-use bullet --- docs/specification/common/identity-linking/index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/specification/common/identity-linking/index.md b/docs/specification/common/identity-linking/index.md index 13c428fec..88046f036 100644 --- a/docs/specification/common/identity-linking/index.md +++ b/docs/specification/common/identity-linking/index.md @@ -1018,10 +1018,10 @@ field conveys the business's value prompt to the platform (e.g., * **JWT grant lifetime.** JWT authorization grants **MUST** be short-lived; the `exp` claim **SHOULD** be no more than 60 seconds after `iat`. Short lifetimes limit the window for grant theft and replay. -* **JWT grant single-use.** Businesses **MUST** enforce single-use JWT; - a short exp narrows the replay window, but only jti tracking closes it. +* **JWT grant single-use.** Businesses **MUST** enforce single-use JWT authorization grants by tracking the `jti` claim within the grant's - validity window. + validity window. A short `exp` narrows the replay window, but only + `jti` tracking closes it. * **Grant relay.** Businesses **MUST NOT** store or forward JWT authorization grants received from platforms. Grants are bearer credentials scoped to a single audience (`aud`) and a single use.