# Identity token claims

> The claims your server puts in an identity token. Iris checks the signature with your identity secret, then reads the claims.

## Example

A payload with every claim. Only `sub` and `exp` are required.

```json title="payload.json"
{
  "sub": "user_8421",
  "email": "maria@example.com",
  "name": "Maria Lopez",
  "attributes": {
    "plan": "pro",
    "seats": 12
  },
  "exp": 1893456000
}
```

## Header

Iris accepts only `HS256`. A token signed with another algorithm fails with `401`.

```json title="header.json"
{ "alg": "HS256", "typ": "JWT" }
```

## Claims

| Name | Type | Required | Default | Description | Example |
| --- | --- | --- | --- | --- | --- |
| `sub` | `string` | Yes |  | Your user's id in your product. Use an id that never changes, not the email. Iris finds the contact by it. Length: 1 to 255 characters. | `sub: "user_8421"` |
| `email` | `string (email)` | No |  | The contact's email. Agents see it on the contact. Length: up to 320 characters. | `email: "maria@example.com"` |
| `name` | `string` | No |  | The contact's name. Agents see it in the inbox and on the contact. Iris removes spaces at the start and the end. Length: 1 to 200 characters. | `name: "Maria Lopez"` |
| `attributes` | `object` | No |  | Contact attributes: stable facts about the contact, such as their plan or role. They stay on the contact until you send a new value. Iris checks your signature, so the browser cannot change them. [Page context](/guides/page-context/) has no such check. Size: up to 50 keys. | `attributes: { plan: "pro", seats: 12 }` |
| `attributes.<key>` | `string \| number \| boolean \| null` | No |  | Iris keeps the keys in the order you send them. Key: up to 64 characters. String value: up to 500 characters. | `plan: "pro"` |
| `exp` | `number` | Yes |  | When the identity token expires. Iris rejects an expired token with `401`, so give the widget a new one before then. One hour is a good default. Format: Unix time in seconds. | `exp: 1893456000` |

## Updating a contact

Call `Iris.identify` with a new identity token. A claim you leave out keeps the stored value. A token with only `sub` and `exp` keeps the name, email and contact attributes that Iris already has.

```js title="app.js"
Iris.identify({ token: newToken });
```