Yes. In a web setting (the most common use case for JWT), they are typically issued during an oauth dance.