Token claims

Every claim in an ID token, an access token and the userinfo response, with when it is present.

On this page

This page lists what is inside the tokens identity issues. Read the Sessions and tokens concept first if you want the picture of who receives which token. Verify a token with your SDK or Protect your API rather than decoding it by hand.

An optional claim is omitted, never sent as null. A claim that is absent can mean "not released to you" or "there is no value", and a client cannot tell the two apart. That is deliberate.

Access token#

An access token is a signed JWT with the header typ set to at+jwt (RFC 9068). It is signed with EdDSA, or ES256 for a client registered for it. It is issued to exactly one audience.

Claim	Present	Meaning
`iss`	Always	The issuer address from discovery.
`sub`	Always	The stable identifier of the person or service the token acts for. Always the real identifier, even for a client that sees a pairwise `sub` in its ID token.
`aud`	Always	One value: the client id, or the one resource address the client asked for with `resource` (RFC 8707). Never a list.
`client_id`	Always	The client the token was issued to.
`jti`	Always	A unique token identifier.
`iat`, `nbf`	Always	Issue time. `nbf` equals `iat`.
`exp`	Always	Expiry. `exp` minus `iat` is at most 900 seconds.
`scope`	Always	The granted scopes, separated by spaces.
`ver`	Always	The claim-shape version. The value is `2`.
`kind`	Always	The kind of principal: `human`, `service`, `workload` or `agent`.
`azp`	When the audience is a resource address, or the token came from a token exchange	The client that asked for the token.
`tid`, `tslug`	When an organization applies	The organization id and its slug, whenever the sign-in belongs to an organization.
`sid`	When a person's session is behind the token	The session id. It matches the `sid` in the ID token and in a back-channel logout token.
`acr`, `amr`, `auth_time`	When a person signed in	The assurance level, the methods used and the time of authentication. See Assurance and method values. Omitted on a `client_credentials` token, because no person authenticated.
`cnf`	When the token is bound to a key	`jkt` for a DPoP key, or `x5t#S256` for a certificate. Present for every client except a first-party web client.
`authorization_details`	When the request carried them	The validated RFC 9396 details.
`act`	On an exchanged token	The actor, as `sub` and `client_id`, with earlier actors nested. The chain is at most three deep.
`av`, `pv`, `pvt`, `rv`	When identity has a value	Version counters identity uses to tell that an authorization decision has changed. `rv` is the organization's resource version and is present only with `tid`. Treat them as opaque.

There is no roles claim. See Authorization.

ID token#

An ID token tells the application who signed in and how. Its aud is always the client id, and it lives as long as the access token does.

Claim	Present	Meaning
`iss`, `sub`, `aud`, `exp`, `iat`	Always	Standard claims. For a client registered with the `pairwise` subject type, `sub` is a value specific to the client's sector rather than the person's real identifier.
`auth_time`	Always	When the person authenticated, in seconds since the epoch.
`acr`, `amr`	Always	Assurance level and methods.
`sid`	Always	The session id.
`ver`	Always	The claim-shape version, `2`.
`nonce`	When the authorization request had one	Echoed unchanged.
`tid`, `tslug`	When an organization applies	The organization id and slug.

Profile claims are released by scope.

Scope	Claims released
`profile`	`name`, `locale`, `zoneinfo`, `preferred_username`, `picture`, `updated_at`
`email`	`email`, `email_verified`

Only a verified primary address is ever released as email. preferred_username is a display hint: it can change and be reused, so never key an account on it. picture is a link to the person's picture, versioned so a change shows up. A pairwise client is sent no picture.

Userinfo#

The userinfo endpoint answers with sub and the same profile claims, according to the scopes on the access token. For a pairwise client the sub is its pairwise value. Discovery lists more in claims_supported: sub, name, email, email_verified, locale, zoneinfo, preferred_username, picture, updated_at, tid, tslug, acr, amr, auth_time and sid. But tid, tslug, acr, amr, auth_time and sid are not returned by userinfo: they are claims of the ID token and the access token. Read the endpoint address from discovery; see OIDC endpoints.

Access token#

ID token#

Userinfo#

Related#