title: Azure AD JWT token: how to see through which client secret it was granted
body: <p>I have an Azure AD application and have generated two client secrets. I can get a JWT access token using each secret (via <code>client_credentials</code> grant) but can I also see from the JWT token via which client secret it was requested?</p>
  
  <p>If I inspect the JWT tokens I get back, some payload fields are always the same (<code>aud</code>, <code>iss</code>, etc) and some are always different (<code>iat</code>, <code>nbf</code>, <code>aio</code>, etc) but there is no info as far as I can tell that identifies the client secret that was used.</p>
  
  <p>Here's an example payload:</p>
  
  <pre><code>{
    "aud": "https://graph.microsoft.com",
    "iss": "https://sts.windows.net/e402c5fb-58e9-48c3-b567-741c4cef0b96/",
    "iat": 1516886787,
    "nbf": 1516886787,
    "exp": 1516890687,
    "aio": "Y2NgYEjJqF0stqv73u41a6ZmxPEvBgA=",
    "app_displayname": "TravelAgencies",
    "appid": "ee8cf944-bf6f-42cf-ae30-6060412416a1",
    "appidacr": "2",
    "e_exp": 262800,
    "idp": "https://sts.windows.net/e402c5fb-58e9-48c3-b567-741c4cef0b96/",
    "oid": "bc430bc6-d9fb-4fa0-87e5-8b8803fcb222",
    "sub": "bc430bc6-d9fb-4fa0-87e5-8b8803fcb222",
    "tid": "e402c5fb-58e9-48c3-b567-741c4cef0b96",
    "uti": "1TgusyfGtECjErT0Kv4PAA",
    "ver": "1.0"
  }
  </code></pre>
  
  <p>On a related note: what are the <code>aio</code>, <code>e_exp</code> and <code>uti</code> fields for? I can't find any information on them.</p>