An Okta access token from a custom authorization server has iss in the form https://{yourOktaDomain}/oauth2/{authServerId}. cid is the client ID that requested the token, and scp is an array of granted scopes (not a space-delimited string, unlike some other providers' scope claim).
A groups claim only appears if you've explicitly configured your authorization server to include it — it's not there by default, and requires both the openid and groups scopes to be requested.