Hello Xiaoling, Internally, Keycloak does track NBF value on the realm, client and user levels, but never propagates it to the tokens. It can only be seen as the "not-before-policy" property of the token response. Not sure if it's a bug, I hope Keycloak developers can tell more about it. As a workaround, you can either: - hardcode a non-zero value into the "nbf" claim, using Hardcoded Claim mapper in your client, or - compute the value similarly to how it is done in TokenManager [1], using Script Mapper and setting it via the token.notBefore() method. [1] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... Good luck, Dmitry Telegin CTO, Acutus s.r.o. Keycloak Consulting and Training Pod lipami street 339/52, 130 00 Prague 3, Czech Republic +42 (022) 888-30-71 E-mail: info(a)acutus.pro On Tue, 2019-01-22 at 17:20 +0000, Xiaoling Chen wrote: