Additional custom or provider-specific claims.
OptionalacrAuthentication Context Class Reference. Indicates the assurance level of the authentication performed.
OptionaladdressPostal address.
OptionalamrAuthentication Methods References. Lists the authentication methods used (for example: pwd, mfa, otp).
Optionalat_Access token hash. Used to validate access tokens returned alongside the ID token.
Intended audience(s) of the ID token.
Optionalauth_Time when the end-user authentication occurred (Unix epoch seconds).
OptionalazpAuthorized party - identifies the client to which the ID token was issued.
OptionalbirthdateBirthday.
Optionalc_Authorization code hash. Used to validate authorization codes returned with hybrid flows.
OptionalemailEmail address.
Optionalemail_Whether the email address has been verified by the provider.
Expiration time of the ID token (Unix epoch seconds).
Optionalfamily_Surname(s) / last name.
OptionalgenderGender.
Optionalgiven_Given name(s) / first name.
OptionalgroupsGroup memberships for the user.
Time at which the ID token was issued (Unix epoch seconds).
Issuer identifier - the authorization server that issued the token.
OptionallocaleLocale.
Optionalmiddle_Middle name(s).
OptionalnameFull name of the user (e.g. "Jane Doe").
OptionalnicknameCasual name used by the user.
OptionalnonceNonce value used to associate the authentication request with the issued ID token and prevent replay attacks.
Optionalphone_Phone number (formatted in E.164 standard).
Optionalphone_Whether the phone number has been verified by the provider.
OptionalpictureURL of the user's profile picture.
Optionalpreferred_Preferred username.
OptionalprofileURL of the user's profile page.
Optionals_State hash (used in some hybrid flow validations).
Subject identifier — uniquely identifies the authenticated user.
Optionalupdated_Time the user's information was last updated (seconds since epoch).
OptionalwebsiteURL of the user's website.
OptionalzoneinfoTime zone name.
Standard OpenID Connect ID Token claims.