Token refreshed
JWT (HS256 or ES256)
Token TTL in seconds
True if MFA step is needed before full access