diff --git a/plugins/experimental/uri_signing/jwt.c b/plugins/experimental/uri_signing/jwt.c
index d509659ec7d..da4e804f25f 100644
--- a/plugins/experimental/uri_signing/jwt.c
+++ b/plugins/experimental/uri_signing/jwt.c
@@ -63,6 +63,7 @@ parse_jwt(json_t *raw)
   jwt->cdniv      = parse_integer_default(json_object_get(raw, "cdniv"), 1);
   jwt->cdniets    = json_integer_value(json_object_get(raw, "cdniets"));
   jwt->cdnistt    = json_integer_value(json_object_get(raw, "cdnistt"));
+  jwt->cdnicrit   = json_string_value(json_object_get(raw, "cdnicrit"));
   return jwt;
 }
 
@@ -136,6 +137,11 @@ jwt_validate(struct jwt *jwt)
     return false;
   }
 
+  if (!unsupported_string_claim(jwt->cdnicrit)) {
+    PluginDebug("Initial JWT Failure: cdnicrit unsupported");
+    return false;
+  }
+
   if (jwt->cdnistt < 0 || jwt->cdnistt > 1) {
     PluginDebug("Initial JWT Failure: unsupported value for cdnistt: %d", jwt->cdnistt);
     return false;
diff --git a/plugins/experimental/uri_signing/jwt.h b/plugins/experimental/uri_signing/jwt.h
index 786e6b9db13..1604eeac1b2 100644
--- a/plugins/experimental/uri_signing/jwt.h
+++ b/plugins/experimental/uri_signing/jwt.h
@@ -28,6 +28,7 @@ struct jwt {
   double nbf;
   double iat;
   const char *jti;
+  const char *cdnicrit;
   int cdniv;
   int cdniets;
   int cdnistt;