Issuer. The app should set the iss claim to the URL of the token endpoint,
since it's the token endpoint the one who issues the JWT.
Example:
const iss = 'https://example.com/token'
If you follow the OpenID Connect Discovery standard, the iss value should
match the URL of your .well-known/openid-configuration file (if you have
one).
Key ID that will be used to sign the JWT. It should be a JSON Web Key (JWK) from a JSON Web Key Set (JWKS).
Expiration for the access token. A pretty common choice is to set the access token lifetime to is one hour.