OIDC Standard Claims and Scopes

Below is the list of standard claims defined by OIDC:

Claim	Type	Description
`sub`	string	Subject – A unique identifier for the user. This identifier may or may not be different for each relying party for a given user. This value is guaranteed not to change even if the user changes the properties of their account (for example, changes email address or phone number). Your application, if it wants to store user data, should use the Subject string as the unique identifier.
`name`	string	Full name of the subject (that is, first name and last name)
`family_name`	string	Last name of the subject
`given_name`	string	First name of the subject
`picture`	string	URL to the subject’s profile picture hosted on the issuer’s server, if any
`locale`	string	Language setting of the subject
`updated_at`	integer	The last time the subject’s profile was updated
`email`	string	Email address of the subject
`email_verified`	boolean	Specifies whether the email address has been verified
`phone_number`	string	Phone number of the subject
`phone_number_verified`	boolean	Specifies whether the phone number has been verified

The OIDC standard defines several scopes that map to standard claims as below:

Scope	Claims
`openid`	Enables OIDC by requesting the ID Token (in addition to an access token). Without this scope, the request is not OIDC, but merely OAuth 2.0.
`profile`	`name, family_name, given_name, picture, locale, updated_at`
`email`	`email, email_verified`
`phone`	`phone_number, phone_number_verified`
`offline_access`	Requests that a refresh token be issued (in addition to an access token).

When an RP requests a scope, this signifies to server that it is asking for all the claims to which that scope maps. In other words, to request the email scope is to request both the email and email_verified claims. Digital Identity Management includes additional scopes and claims data for RPs. For the list of additional scopes and claims data for RPs, refer to the Digital Identity Management Support section. Parent topic:OAuth 2.0 and OpenID Connect

Home

Guides

APIs