From bb9e7fe2a950e40ab3ae58a9b5f0c7f2aa161561 Mon Sep 17 00:00:00 2001 From: YanisMtcr Date: Sun, 23 Aug 2026 16:36:43 +0200 Subject: [PATCH] docs: fix garbled sentence in the JWT grant single-use requirement The exp clause was inserted mid-sentence, splitting "single-use JWT authorization grants" and leaving a dangling fragment. Rejoin the sentence; no normative change. --- docs/specification/common/identity-linking/index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/specification/common/identity-linking/index.md b/docs/specification/common/identity-linking/index.md index 13c428fec..0f2bce918 100644 --- a/docs/specification/common/identity-linking/index.md +++ b/docs/specification/common/identity-linking/index.md @@ -1018,10 +1018,10 @@ field conveys the business's value prompt to the platform (e.g., * **JWT grant lifetime.** JWT authorization grants **MUST** be short-lived; the `exp` claim **SHOULD** be no more than 60 seconds after `iat`. Short lifetimes limit the window for grant theft and replay. -* **JWT grant single-use.** Businesses **MUST** enforce single-use JWT; - a short exp narrows the replay window, but only jti tracking closes it. +* **JWT grant single-use.** Businesses **MUST** enforce single-use JWT authorization grants by tracking the `jti` claim within the grant's - validity window. + validity window; a short `exp` narrows the replay window, but only + `jti` tracking closes it. * **Grant relay.** Businesses **MUST NOT** store or forward JWT authorization grants received from platforms. Grants are bearer credentials scoped to a single audience (`aud`) and a single use.