Comment by 0xEFF

Every access and id token issued by oidc already has an issued at (iat) and expiration (exp) fields.