Additional provider-specific claims.
OptionalacrAuthentication Context Class Reference. Indicates the assurance level of the authentication performed.
OptionaladdressPostal address.
OptionalamrAuthentication Methods References. Lists the authentication methods used (for example: pwd, mfa, otp).
Optionalat_Access token hash. Used to validate access tokens returned alongside the ID token.
Intended audience(s) of the token.
Optionalauth_Time when the end-user authentication occurred (Unix epoch seconds).
OptionalazpAuthorized party - identifies the client to which the ID token was issued.
OptionalbirthdateBirthday.
Optionalc_Authorization code hash. Used to validate authorization codes returned with hybrid flows.
OptionalemailEmail address.
Optionalemail_Whether the email address has been verified by the provider.
Expiration time of the token (Unix epoch seconds).
Optionalfamily_Surname(s) / last name.
OptionalgenderGender.
Optionalgiven_Given name(s) / first name.
OptionalgroupsGroup memberships for the user.
Time at which the token was issued (Unix epoch seconds).
Issuer identifier - the authorization server that issued the token.
OptionallocaleLocale.
Optionalmiddle_Middle name(s).
OptionalnameFull name of the user (e.g. "Jane Doe").
OptionalnbfNot-before time (Unix epoch seconds).
OptionalnicknameCasual name used by the user.
OptionalnonceNonce value used to associate the authentication request with the issued ID token and prevent replay attacks.
Optionalphone_Phone number (formatted in E.164 standard).
Optionalphone_Whether the phone number has been verified by the provider.
OptionalpictureURL of the user's profile picture.
Optionalpreferred_Preferred username.
OptionalprofileURL of the user's profile page.
Optionals_State hash (used in some hybrid flow validations).
Subject identifier - a unique, stable identifier for the user within the issuer.
Optionalupdated_Time the user's information was last updated (seconds since epoch).
OptionalwebsiteURL of the user's website.
OptionalzoneinfoTime zone name.
Standard OpenID Connect ID Token claims.