Expiry (seconds since epoch).
Issued-at (seconds since epoch).
Unique token id — enables single-link revocation.
Optional
Key id (for rotation). Mirrors the JWS header kid.
kid
Granted access role.
Room id this token grants access to.
Expiry (seconds since epoch).