Claims reference

Every claim in identity's ID tokens, access tokens and userinfo response, its type, where it appears and which scope releases it.

On this page

This page lists every claim identity puts in a token or in the userinfo response. In the Where column, ID is the ID token, AT the access token and UI the userinfo response.

A claim is left out when it has no value. It is never sent as null, so a missing claim tells you only that it does not apply or was not released. Treat every claim you do not recognise as opaque and ignore it.

Core claims#

Claim	Type	Where	Meaning
`iss`	string	ID, AT	The issuer. Compare it exactly.
`sub`	string	ID, AT, UI	The person's stable identifier. For a client with the `public` subject type (the default) it is the same for every client. A third-party client registered with the `pairwise` subject type sees a different value, one per sector, in its ID token, in userinfo, in its back-channel logout token and in security event tokens; its access tokens still carry the real identifier. Key accounts on it. For a service it is the service's identifier.
`aud`	string	ID, AT	The audience. On an ID token, your client id. On an access token, exactly one value: see Access token.
`exp`, `iat`	number	ID, AT	Expiry and issue time, seconds since the epoch. At most 900 seconds apart.
`nbf`	number	AT	Not valid before. Equal to `iat`.
`jti`	string	AT	A unique token identifier.
`ver`	number	ID, AT	The claim-set version. Currently `2`. A future incompatible change raises it.

Client and request claims#

Claim	Type	Where	Meaning
`client_id`	string	AT	The client the token was issued to.
`azp`	string	AT	The client that asked, when the token's audience is a resource or comes from an exchange.
`scope`	string	AT	The granted scopes, space separated.
`nonce`	string	ID	The value pushed with the request.
`authorization_details`	array	AT	RFC 9396 details from the request, when one was made.

Authentication claims#

Claim	Type	Where	Meaning
`auth_time`	number	ID, AT	When the person last authenticated.
`acr`	string	ID, AT	The assurance level, `aal1`, `aal2` or `aal3`.
`amr`	array of strings	ID, AT	The methods used. Both are defined in acr and amr values.
`sid`	string	ID, AT	The identity session. Matches the `sid` of a back-channel logout token.

On a client_credentials access token, acr, amr, auth_time and sid are absent, because no person authenticated.

Organization claims#

Claim	Type	Where	Meaning
`tid`	string	ID, AT	The organization the sign-in is for. Present when the authorization is for an organization.
`tslug`	string	ID, AT	The organization's slug. Present with `tid`.

The tid and tslug claims are present whenever the sign-in belongs to an organization; they are not gated on a scope. A request can preselect an organization with tdaid_tenant. See Scopes and consent.

Authorization version claims#

Claim	Type	Where	Meaning
`av`	number	AT	The person's authorization version. It increases when something about their access changes.
`pv`	number	AT	The product's policy version, when one applies.
`pvt`	number	AT	The organization's policy version, when there is one.
`rv`	number	AT	The organization's resource version. Present only with `tid`.

These are counters for the decision API and its caches. Do not interpret the values; compare them for equality.

Binding and actor claims#

Claim	Type	Where	Meaning
`cnf`	object	AT	The key the token is bound to: `jkt`, the DPoP key thumbprint, or `x5t#S256`, a certificate thumbprint. Absent on a token from a first-party web client that did not prove a key.
`act`	object	AT	On an exchanged token, the actor, with `sub`, `client_id` and any earlier actor nested inside.
`kind`	string	AT	The kind of principal: `human`, `service`, `workload` or `agent`.

Profile claims#

Released to the ID token and userinfo by the scope shown.

Claim	Type	Scope	Meaning
`name`	string	`profile`	The display name.
`preferred_username`	string	`profile`	The username. A hint to display, not an identifier: it can change and be reused.
`picture`	string	`profile`	An address on the issuer for the profile picture. It changes when the picture does.
`locale`	string	`profile`	The language.
`zoneinfo`	string	`profile`	The time zone.
`updated_at`	number	`profile`	When the profile last changed, seconds since the epoch.
`email`	string	`email`	The verified primary email. Left out when there is none.
`email_verified`	boolean	`email`	Whether `email` is verified.

The openid scope alone releases sub and nothing about the person. See the scopes reference.

What is not here#

No roles or permission claims. Ask the decision API.
No at_hash or azp on ID tokens.
Pairwise subjects only by registration. A client sees a per-sector sub only if it was registered with the pairwise subject type, which is fixed at registration. Discovery lists public and pairwise under subject_types_supported. A pairwise client is also sent no picture, because that address is built from the real identifier.
Userinfo returns only sub and the profile claims above. The discovery document lists tid, tslug, acr, amr, auth_time and sid under claims_supported, but those are claims of the tokens.