An Auth0-issued token typically has iss set to your tenant domain (https://your-tenant.us.auth0.com/), sub in the form auth0|<user-id> (or a provider prefix like google-oauth2| for social logins), and aud as an array when the token is valid for multiple audiences.
Custom claims need a namespace. Auth0 silently drops any custom claim that isn't a full URL you control (e.g. https://your-app.example.com/roles) — a bare key like roles won't survive. This is an OIDC spec requirement to avoid collisions with reserved claim names, not an Auth0-specific quirk, but it trips people up constantly.
The sample token below is illustrative, not a real user's — decoding shows the shape without needing a live Auth0 tenant.