iss = who minted it, aud = who may accept it, exp = until when.

When several services trust the same issuer and the same key, a valid signature and a future expiry say nothing about which service the token was made for. Only the audience claim names the intended recipient, and each service must insist that its own name is there. Issuer matters when you accept tokens from more than one provider.

Read it once, then a question tests whether the trick stuck.