That is basically it: Additional restriction applied to the token.

I was actually referencing this article: https://auth0.com/blog/2014/12/02/using-json-web-tokens-as-a...