{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"OpenID Connect & OAuth 2.0","description":"Okta Developer API Reference","siteUrl":"https://okta-developer.pixtulate.com","keywords":"okta, api reference docs","lang":"en-US"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"openid-connect--oauth-20","__idx":0},"children":["OpenID Connect & OAuth 2.0"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Okta is a standards-compliant ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://oauth.net/documentation"},"children":["OAuth 2.0"]}," authorization server and a certified ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://openid.net/certification"},"children":["OpenID Connect provider"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OpenID Connect extends OAuth 2.0. The OAuth 2.0 protocol provides API security via scoped access tokens, and OpenID Connect provides user authentication and single sign-on (SSO) functionality."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page contains detailed information about the OAuth 2.0 and OpenID Connect endpoints that Okta exposes on its authorization servers. For higher-level information about how to use these endpoints, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/concepts/oauth-openid/"},"children":["OAuth 2.0 and OpenID Connect"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"scopes","__idx":1},"children":["Scopes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OpenID Connect uses scope values to specify which access privileges are being requested for access tokens."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The scopes associated with access tokens determine which claims are available when they are used"," ","to access the OIDC ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/userinfo"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/userinfo"]}," endpoint"]},". See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/oauth2"},"children":["OAuth 2.0 scopes"]}," for a full list of scopes."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"scope-values","__idx":2},"children":["Scope values"]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note:"]}," The maximum length for the scope parameter value is 1024 characters."]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["openid"]}," is required for any OpenID request connect flow. If the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["openid"]}," scope value isn't present, the request may be a valid OAuth 2.0 request, but it's not an OpenID Connect request."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["profile"]}," requests access to these default profile claims: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["name"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["family_name"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["given_name"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["middle_name"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["nickname"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["preferred_username"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["profile"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["picture"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["website"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["gender"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["birthdate"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["zoneinfo"]},",",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["locale"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["updated_at"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]}," can only be requested in combination with a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_type"]}," that contains ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]},". If the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_type"]}," doesn't contain ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]}," is ignored."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For more information about ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]},", see the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess"},"children":["OIDC spec"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For more information about ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["device_sso"]},", see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/guides/configure-native-sso/main/"},"children":["Native SSO"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"scope-properties","__idx":3},"children":["Scope properties"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Property"},"children":["Property"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Default"},"children":["Default"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Required for create or update"},"children":["Required for create or update"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["consent"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Indicates whether a consent dialog is needed for the scope. Valid values: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REQUIRED"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["IMPLICIT"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Enum"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["IMPLICIT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["True"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"x-lifecycle","attributes":{"className":"ea"},"children":[]}," optional"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Indicates whether the Scope is optional. When set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},", the user can skip consent for the scope."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Boolean"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["False"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["False"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["default"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Whether the scope is a default scope"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Boolean"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["False"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["description"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Description of the scope"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["False"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["displayName"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Name of the end user displayed in a consent dialog window"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["False"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["id"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["ID of the scope"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["False"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["metadataPublish"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Whether the scope should be included in the metadata. Valid values: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["NO_CLIENTS"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ALL_CLIENTS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Enum"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["NO_CLIENTS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["True except for create"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["name"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Name of the scope"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["True"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["system"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Whether Okta created the scope"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Boolean"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["False"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A consent dialog appears depending on the values of three elements:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["prompt"]}," - a query parameter that is used in requests to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/api/openapi/okta-oauth/oauth/orgas/authorize"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/authorize"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["consent_method"]}," - an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-management/management/tags/application/other/createapplication#application/createapplication/t=response&c=200&path=&d=0/settings"},"children":["application"]}," property that allows you to determine whether a client is fully trusted (for example, a first-party application) or requires consent (for example, a third-party application)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["consent"]}," - a Scope property, listed in the previous table, that allows you to enable or disable user consent for an individual scope."]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"prompt Value"},"children":["prompt Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"consent_method"},"children":["consent_method"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"consent"},"children":["consent"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Result"},"children":["Result"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CONSENT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TRUSTED"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REQUIRED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REQUIRED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Prompted"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CONSENT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TRUSTED"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REQUIRED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FLEXIBLE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Prompted"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CONSENT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TRUSTED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["IMPLICIT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Not prompted"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["NONE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TRUSTED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FLEXIBLE"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["IMPLICIT"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REQUIRED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Not prompted"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["NONE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REQUIRED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FLEXIBLE"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REQUIRED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Prompted"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["NONE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REQUIRED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["IMPLICIT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Not prompted"]}]}]}]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note:"]}," When a scope is requested during a Client Credentials grant flow and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CONSENT"]}," is set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FLEXIBLE"]},", the scope is granted in the access token with no consent prompt. This occurs because there is no user involved in a two-legged OAuth ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/guides/implement-grant-type/clientcreds/main/"},"children":["Client Credentials"]}," grant flow."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Notes:"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Apps created on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/api/v1/apps"]}," default to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["consent_method=TRUSTED"]},", while those created on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/api/v1/clients"]}," default to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["consent_method=REQUIRED"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If you request a scope that requires consent while using the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_credentials"]}," flow, an error is returned. Because there is no user, no consent can be given."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["prompt"]}," value is set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["NONE"]},", but the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["consent_method"]}," and the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["consent"]}," values are ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REQUIRED"]},", then an error occurs."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The scope name must only contain printable ASCII except for spaces, double quotes, and backslashes. It also must not start with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["okta."]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["okta:"]}," and must not be only ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["okta"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["*"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"tokens-and-claims","__idx":4},"children":["Tokens and claims"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This section contains some general information about claims, as well as detailed information about access and ID tokens."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#access-token"},"children":["Access Token"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#id-token"},"children":["ID Token"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#refresh-token"},"children":["Refresh Token"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"token-lifetime","__idx":5},"children":["Token lifetime"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you are using the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/concepts/auth-servers/#org-authorization-server"},"children":["Okta Authorization Server"]},", the lifetime of the JWT tokens is hard-coded to the following values:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ID token:"]}," 60 minutes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access token:"]}," 60 minutes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Refresh token:"]}," 90 days"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you are using a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/concepts/auth-servers/#custom-authorization-server"},"children":["Custom Authorization Server"]},", you can configure the lifetime of the JWT tokens:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access tokens:"]}," The minimum is five minutes, and the maximum is 24 hours (configurable using an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-help.pixtulate.com/okta_help.htm?id=ext-create-access-policies"},"children":["Access Policy"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Refresh tokens:"]}," The minimum access token lifetime. The idle time window is at least 10 minutes, with a maximum of five years (configurable using an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-help.pixtulate.com/okta_help.htm?id=ext-create-access-policies"},"children":["Access Policy"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ID tokens:"]}," Not configurable. Token lifetime is 60 minutes."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"claims","__idx":6},"children":["Claims"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Tokens issued by Okta contain claims that are statements about a subject (user). For example, the claim can be about a name, identity, key, group, or privilege. The claims in a security token are dependent upon the type of token, the type of credential used to authenticate the user, and the application configuration."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The claims requested by the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["profile"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["address"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["phone"]}," scope values are returned from the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/userinfo"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/userinfo"]}," endpoint"]}," when a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_type"]}," value is used that results in an access token being issued. However, when no access token is issued (which is the case for the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_type"]}," value ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id_token"]},"), the resulting claims are returned in the ID token."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"access-token","__idx":7},"children":["Access token"]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note:"]}," Use of the access token differs depending on whether you are using the Okta Org Authorization Server or a Custom Authorization Server. While the structure of an access token retrieved from a Custom Authorization Server is guaranteed to not change, the structure of the access token issued by the Okta Org Authorization Server is subject to change."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["An access token is a JSON web token (JWT) encoded in Base64 URL-encoded format that contains ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#access-token-header"},"children":["a header"]},", ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#access-token-payload"},"children":["payload"]},", and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#access-token-signature"},"children":["signature"]},". A resource server can authorize the client to access particular resources based on the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#access-token-scopes-and-claims"},"children":["scopes and claims"]}," in the access token."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The lifetime of an access token can be configured in access policies. If the client that issued the token is deactivated, the token is immediately and permanently invalidated. Reactivating the client doesn't make the token valid again."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"access-token-header","__idx":8},"children":["Access token header"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"alg\": \"RS256\",\n  \"kid\": \"45js03w0djwedsw\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"access-token-payload","__idx":9},"children":["Access token payload"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"ver\": 1,\n  \"jti\": \"AT.0mP4JKAZX1iACIT4vbEDF7LpvDVjxypPMf0D7uX39RE\",\n  \"iss\": \"https://{yourOktaDomain}/oauth2/{authorizationServerId}\",\n  \"aud\": \"https://api.example.com\",\n  \"sub\": \"00ujmkLgagxeRrAg20g3\",\n  \"iat\": 1467145094,\n  \"exp\": 1467148694,\n  \"cid\": \"nmdP1fcyvdVO11AL7ECm\",\n  \"uid\": \"00ujmkLgagxeRrAg20g3\",\n  \"scp\": [\n    \"openid\",\n    \"email\",\n    \"flights\",\n    \"custom\"\n  ],\n  \"auth_time\": 1467142021,\n  \"custom_claim\": \"CustomValue\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"access-token-signature","__idx":10},"children":["Access token signature"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is a digital signature that Okta generates using the public key identified by the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kid"]}," property in the header section."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"access-token-scopes-and-claims","__idx":11},"children":["Access token scopes and claims"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Access tokens include reserved scopes and claims and can optionally include custom scopes and claims."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Scopes are requested in the initial ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/authorize"},"children":["authorization request"]},", and the Authorization Server uses the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-management/management/tags/authorizationserverpolicies/other/createauthorizationserverpolicy"},"children":["access policies"]}," to decide whether they can be granted. If any of the requested scopes are rejected by the Access Policies, the request is rejected."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Based on the granted scopes, claims are added into the access token returned from the request."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":5,"id":"reserved-scopes-and-claims","__idx":12},"children":["Reserved scopes and claims"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Okta defines a number of reserved scopes and claims that can't be overridden."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#reserved-scopes"},"children":["Reserved scopes"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#reserved-claims-in-the-header-section"},"children":["Reserved claims in the header section"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#reserved-claims-in-the-payload-section"},"children":["Reserved claims in the payload section"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":6,"id":"reserved-scopes","__idx":13},"children":["Reserved scopes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["openid"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["profile"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["address"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["phone"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["groups"]}," are available to ID tokens and access tokens, using either the Okta Org Authorization Server or a Custom Authorization Server. For details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#access-token-scopes-and-claims"},"children":["Scopes"]},". All of these scopes except ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["groups"]}," are defined in the OpenID Connect specification."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Additionally, we reserved the scope ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["device_sso"]}," as it has a particular meaning in the Native SSO flow."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":6,"id":"reserved-claims-in-the-header-section","__idx":14},"children":["Reserved claims in the header section"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The header only includes the following reserved claims:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Property"},"children":["Property"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"DataType"},"children":["DataType"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["alg"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identifies the digital signature algorithm used. This is always ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RS256"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["String"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["kid"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identifies the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["public-key"]}," used to sign the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]},". The corresponding ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["public-key"]}," can be found via the JWKS in the discovery document of an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/getwellknownopenidconfiguration"},"children":["Org Authorization Server"]}," or a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/api/openapi/okta-oauth/oauth/customas/getwellknownoauthconfigurationcustomas"},"children":["Custom Authorization Server"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["String"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":6,"id":"reserved-claims-in-the-payload-section","__idx":15},"children":["Reserved claims in the payload section"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The payload includes the following reserved claims:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Property"},"children":["Property"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"DataType"},"children":["DataType"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["auth_time"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The time the end user was authenticated, represented in Unix time (seconds)."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Integer"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["cid"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID of the client that requested the access token."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["String"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["exp"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The time the access token expires, represented in Unix time (seconds)."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Integer"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["iat"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The time the access token was issued, represented in Unix time (seconds)."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Integer"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["iss"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The Issuer Identifier of the response. This value is the unique identifier for the Authorization Server instance."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["String"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["jti"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A unique identifier for this access token for debugging and revocation purposes."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["String"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["scp"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Array of scopes that are granted to this access token."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Array"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["uid"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A unique identifier for the user. It isn't included in the access token if there is no user bound to it."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["String"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["ver"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The semantic version of the access token."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Integer"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"x-lifecycle","attributes":{"className":"ea"},"children":[]}," acr"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Information about the level of assurance that the user verified at the time of authentication"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["String"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":5,"id":"custom-scopes-and-claims","__idx":16},"children":["Custom scopes and claims"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can configure custom scopes and claims for your access tokens, depending on the authorization server that you are using:"]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note:"]}," Okta has two types of authorization servers: the org authorization server and the custom authorization server. To learn more about each type of authorization server and when to use them, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/concepts/auth-servers/"},"children":["Authorization servers"]},"."]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For the Okta Org Authorization Server, you can configure a custom ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["groups"]}," claim."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For a Custom Authorization Server, you can configure a custom ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["groups"]}," claim or any other custom scopes and claims you want."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":6,"id":"custom-scopes","__idx":17},"children":["Custom scopes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the request that generates the access token contains any custom scopes, those scopes are a part of the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scp"]}," claim together with the reserved scopes provided from the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://openid.net/specs/openid-connect-core-1_0.html"},"children":["OIDC specification"]},". The names of your custom scopes must conform to the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://tools.ietf.org/html/rfc6749#section-3.3"},"children":["OAuth 2.0 specification"]},"."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note:"]}," Scope names can contain the characters ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["<"]}," (less than) or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[">"]}," (greater than), but not both characters."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":6,"id":"custom-claims","__idx":18},"children":["Custom claims"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Custom claims are associated with scopes. In general, granting a custom scope means a custom claim is added to the token. However, the specifics depend on which claims are requested, whether the request is to the Okta Org Authorization Server or a Custom Authorization Server, and some configuration choices."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Quick Reference: Which token has which claims?"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Custom claims are configured in the Custom Authorization Server, and returned depending on whether it matches a scope in the request, and also depending on the token type, authorization server type, and the token and claim configuration set in the authorization server:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Base claims are always returned in ID tokens and access tokens for both authorization server types (Okta Org Authorization Server or Custom Authorization Server)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Scope-dependent claims are returned in tokens depending on the response type for either authorization server type. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#scope-dependent-claims-not-always-returned"},"children":["the second table in the Scope-dependent claims topic"]}," for details."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Custom claims require configuration in the Custom Authorization Server. You can specify that claims be returned in each token (ID or access) always or only when requested. Assuming a claim matches a requested scope, it is returned to the ID token if there is no access token requested."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ID token or access token may not include all claims associated with the requested scopes. The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/userinfo"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/userinfo"]}," endpoint"]}," always contains a full set of claims for the requested scopes."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"id-token","__idx":19},"children":["ID token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OpenID Connect introduces an ID token that is a JSON Web Token (JWT) that contains information about an authentication event and claims about the authenticated user."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Clients can use any of the following sequences of operations to obtain an ID token:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/guides/implement-grant-type/authcode/main/"},"children":["Authorization code flow"]}," or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/guides/implement-grant-type/authcodepkce/main/"},"children":["Authorization code with PKCE flow"]}," -- the client obtains an authorization code from the authorization server's ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/authorize"},"children":["/authorize endpoint"]}," and uses it to obtain an ID token and an access token from the authorization server's ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/token"},"children":["/token endpoint"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/guides/implement-grant-type/implicit/main/"},"children":["Implicit flow"]}," -- the client obtains an ID token and optionally an access token directly from the authorization server's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/authorize"]}," endpoint."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Clients should always ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/guides/validate-id-tokens/"},"children":["validate ID tokens"]}," to ensure their integrity."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ID tokens returned by the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/authorize"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/authorize"]}," endpoint"]}," (implicit flow) or the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/token"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/token"]}," endpoint"]}," (authorization code flow) are identical, except if:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You are using the implicit flow. If so, the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["nonce"]}," parameter is required in the initial ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/authorize"]}," request, and the ID token includes a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["nonce"]}," claim that should be validated to make sure it matches the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["nonce"]}," value passed to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/authorize."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Both an ID and an access token were requested. If so, the ID token includes the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["at_hash"]}," ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken"},"children":["parameter"]}," that can be validated against the hash of the access token to guarantee that the access token is genuine."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ID token consists of three period-separated, Base64 URL-encoded JSON segments: ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#id-token-header"},"children":["a header"]},", ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#id-token-payload"},"children":["the payload"]},", and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#id-token-signature"},"children":["the signature"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"id-token-header","__idx":20},"children":["ID token header"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"alg\": \"RS256\",\n  \"kid\": \"45js03w0djwedsw\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"id-token-payload","__idx":21},"children":["ID token payload"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"ver\": 1,\n  \"sub\": \"00uid4BxXw6I6TV4m0g3\",\n  \"iss\": \"https://{yourOktaDomain}\",\n  \"aud\": \"uAaunofWkaDJxukCFeBx\",\n  \"iat\": 1449624026,\n  \"exp\": 1449627626,\n  \"amr\": [\n    \"pwd\"\n  ],\n  \"jti\": \"ID.4eAWJOCMB3SX8XewDfVR\",\n  \"auth_time\": 1449624026,\n  \"at_hash\": \"cpqKfdQA5eH891Ff5oJr_Q\",\n  \"name\" :\"John Doe\",\n  \"nickname\":\"Jimmy\",\n  \"preferred_username\": \"john.doe@example.com\",\n  \"given_name\":\"John\",\n  \"middle_name\":\"James\",\n  \"family_name\":\"Doe\",\n  \"profile\":\"https://example.com/john.doe\",\n  \"zoneinfo\":\"America/Los_Angeles\",\n  \"locale\":\"en-US\",\n  \"updated_at\":1311280970,\n  \"email\":\"john.doe@example.com\",\n  \"email_verified\":true,\n  \"address\" : { \"street_address\": \"123 Hollywood Blvd.\",\n      \"locality\": \"Los Angeles\",\n      \"region\": \"CA\",\n      \"postal_code\": \"90210\",\n      \"country\": \"US\"\n    },\n  \"phone_number\":\"+1 (425) 555-1212\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"id-token-signature","__idx":22},"children":["ID token signature"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is the digital signature that Okta signs using the public key identified by the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kid"]}," property in the Header section."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"id-token-claims","__idx":23},"children":["ID token claims"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Header and Payload sections contain claims."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":5,"id":"claims-in-the-header-section","__idx":24},"children":["Claims in the Header section"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Claims in the Header are always returned."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Property"},"children":["Property"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"DataType"},"children":["DataType"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["alg"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Identifies the digital signature algorithm used. This is always ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RS256"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["kid"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Identifies the public key used to verify the ID token. The corresponding public key can be found via the JWKS in the discovery document of an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/getwellknownopenidconfiguration"},"children":["Org Authorization Server"]}," or a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/api/openapi/okta-oauth/oauth/customas/getwellknownoauthconfigurationcustomas"},"children":["Custom Authorization Server"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":5,"id":"claims-in-the-payload-section","__idx":25},"children":["Claims in the Payload section"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Claims in the payload are either base claims, independent of scope (always returned), or dependent on scope (not always returned)."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":6,"id":"base-claims-always-present","__idx":26},"children":["Base claims (always present)"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Property"},"children":["Property"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"DataType"},"children":["DataType"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Example"},"children":["Example"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["amr"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["JSON array of strings that are identifiers for ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://self-issued.info/docs/draft-jones-oauth-amr-values-00.html"},"children":["authentication methods"]}," used in the authentication."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Array"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["[ \"pwd\", \"mfa\", \"otp\", \"kba\", \"sms\", \"swk\", \"hwk\" ]"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["aud"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Identifies the audience that this ID token is intended for. It is one of your application's OAuth 2.0 client IDs."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["6joRGIzNCaJfdCPzRjlh"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["auth_time"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The time the end user was authenticated, represented in Unix time (seconds)."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Integer"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["1311280970"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["exp"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The time the ID token expires, represented in Unix time (seconds)."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Integer"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["1311280970"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["iat"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The time the ID token was issued, represented in Unix time (seconds)."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Integer"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["1311280970"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["idp"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The Okta org ID or the ID of an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-management/management/tags/identityprovider"},"children":["Identity Provider"]}," if this authentication used Social Authentication or Inbound SAML."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["00ok1u7AsAkrwdZL3z0g3"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["iss"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The URL of the authorization server that issued this ID token."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://{yourOktaDomain}"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["jti"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["A unique identifier for this ID token for debugging and revocation purposes."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Tlenfse93dgkaksginv"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["sub"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The subject. A unique identifier for the user."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["00uk1u7AsAk6dZL3z0g3"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["ver"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The semantic version of the ID token."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Integer"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["1"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":6,"id":"scope-dependent-claims-not-always-returned","__idx":27},"children":["Scope-dependent claims (not always returned)"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Property"},"children":["Property"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Required Scope"},"children":["Required Scope"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"DataType"},"children":["DataType"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Example"},"children":["Example"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["name"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["User's full name in displayable form including all name parts, possibly including titles and suffixes, ordered according to the user's locale and preferences."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["John Doe"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["nickname"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Casual name of the user that may or may not be the same as the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["given_name"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Jimmy"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["preferred_username"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The chosen login (username) for the end user. By default this is the Okta username."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["john.doe@example.com"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["given_name"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Given name(s) or first name(s) of the user. Note that in some cultures, people can have multiple given names; all can be present, with the names being separated by space characters."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["John"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["middle_name"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Middle name(s) of the user. Note that in some cultures, people can have multiple middle names; all can be present, with the names being separated by space characters. Also note that in some cultures, middle names aren't used."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["James"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["family_name"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Surname(s) or last name(s) of the user. Note that in some cultures, people can have multiple family names or no family name; all can be present, with the names being separated by space characters."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Doe"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["URL of the user's profile page."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://profile.wordpress.com/john.doe"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["zoneinfo"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String that represents the user's time zone."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["America/Los_Angeles"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["locale"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Language and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://www.iso.org/iso/country_codes"},"children":["ISO3166‑1"]}," country code in uppercase, separated by a dash."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["en-US"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["updated_at"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["profile"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Time the user's information was last updated, represented in Unix time (seconds)."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Integer"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["1311280970"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["email"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["email"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["User's preferred email address. The resource provider must not rely on this value being unique."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["john.doe@example.com"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["email_verified"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["email"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["True if the user's email address (Okta primary email) has been verified; otherwise false."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["boolean"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["address"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["address"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["User's preferred postal address. The value of the address member is a JSON structure that contains ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["street_address"]},", ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["locality"]},", ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["region"]},", ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["postal_code"]},", and ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["country"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["JSON structure"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{ \"street_address\": \"123 Hollywood Blvd.\", \"locality\": \"Los Angeles\", \"region\": \"CA\", \"postal_code\": \"90210\", \"country\": \"US\" }"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["phone_number"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["phone"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["User's preferred telephone number in E.164 format."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["+1 (425) 555-1212"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["groups"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["groups"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The groups that the user is a member of that also match the ID token group filter of the client app."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["List"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["[ \"MyGroup1\", \"MyGroup2\", \"MyGroup3\" ]"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Be aware of the following before you work with scope-dependent claims:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["To protect against arbitrarily large numbers of groups matching the group filter, the groups claim has a limit of 100."," ","If more than 100 groups match the filter, then the request fails. Expect that this limit may change in the future."," ","For more information about configuring an app for OpenID Connect, including group claims, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/guides/add-an-external-idp/openidconnect/main/"},"children":["Create a client application"]},"."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Important:"]}," Scope-dependent claims are returned differently depending on the values in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_type"]}," and the scopes requested:"]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Response Type"},"children":["Response Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Claims Returned in ID Token from Org     AS"},"children":["Claims Returned in ID Token from Org     AS"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Claims Returned in ID Token from Custom AS"},"children":["Claims Returned in ID Token from Custom AS"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Claims Returned from Userinfo Endpoint"},"children":["Claims Returned from Userinfo Endpoint"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code "]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["N/A"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["N/A"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["N/A"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["N/A"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["N/A"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["N/A"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Claims associated with requested scopes."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Claims associated with requested scopes."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["N/A"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id_token"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code "]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Claims associated with requested scopes."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Claims associated with requested scopes."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["N/A"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id_token"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]}," if email scope is requested; ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["name"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["preferred_username"]}," if profile scope is requested"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Claims associated with the requested scopes and the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-management/management/tags/authorizationserverclaims/other/createoauth2claim#other/createoauth2claim/t=request&path=alwaysincludeintoken"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["alwaysIncludeinToken"]}," property"]}," set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Claims associated with the requested scopes"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id_token"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]}," if email scope is requested; ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["name"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["preferred_username"]}," if profile scope is requested"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Claims associated with the requested scopes and the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["alwaysIncludeinToken"]}," property set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},"."]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Claims associated with the requested scopes"]}]}]}]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The full set of claims for the requested scopes is available via the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/api/openapi/okta-oauth/oauth/tag/OrgAS/#tag/OrgAS/operation/userinfo"},"children":["/oauth2/v1/userinfo"]}," endpoint. Call this endpoint using the access token."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"refresh-token","__idx":28},"children":["Refresh token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Refresh tokens are opaque. More information about using them can be found in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-developer.pixtulate.com/docs/guides/refresh-tokens/"},"children":["Refresh access tokens"]}," guide."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"json-web-key-set","__idx":29},"children":["JSON Web Key Set"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/oauthkeys"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/keys"]}," endpoint"]}," returns a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc7517"},"children":["JSON Web Key"]}," Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"key-rotation","__idx":30},"children":["Key rotation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The keys that are used to sign tokens are periodically changed. Okta automatically rotates your authorization server's keys on a regular basis."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Clients can opt-out of automatic key rotation by changing the client sign-in mode for the Okta org authorization server. In this case, passing the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," with your request retrieves the keys for that specific client."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Key rotation behaves differently with custom authorization servers. For more information about key rotation with custom authorization servers, see the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-management/management/tags/authorizationserverkeys"},"children":["Authorization Server Keys API"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"alternative-validation","__idx":31},"children":["Alternative validation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can use the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/introspect"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/introspect"]}," endpoint"]}," for validation."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"best-practices","__idx":32},"children":["Best practices"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Okta strongly recommends retrieving keys dynamically with the JWKS published in the discovery document. Okta also recommends caching or persisting these keys to improve performance. If you cache signing keys, and automatic key rotation is enabled, be aware that verification fails when Okta rotates the keys automatically. Clients that cache keys should periodically check the JWKS for updated signing keys."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Okta recommends a background process that regularly caches the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/oauthkeys"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/keys"]}," endpoint"]},". You can schedule this process to run once a day or more infrequently, for example, once per week. This ensures that you always have an up-to-date set of keys for validation even when we generate the next key or rotate automatically at the 45 or 90 day mark respectively."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Under almost all circumstances, the above would be sufficient except in cases where keys were rotated or generated outside the usual timespans. An example of this would be if Okta or a customer had a need to perform this operation for security reasons. You should augment the above approach with a failsafe for circumstances where keys are quickly regenerated and rotated."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Why not just use the second approach? There's potential for the caching of stale data since there's no guarantee that the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/oauthkeys"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/keys"]}," endpoint"]}," is up to date. For example, the keys are rotated, but the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-oauth/oauth/orgas/oauthkeys"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/keys"]}," endpoint"]}," hasn't yet been updated, which results in a period of time where failures occur."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Given that possibility, Okta recommends the blended approach of regularly scheduled caching and just-in-time checking to ensure that all possible scenarios are covered."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":33},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you run into trouble setting up an authorization server or performing other tasks for OAuth 2.0/OIDC, use the following suggestions to resolve your issues."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"start-with-the-system-log","__idx":34},"children":["Start with the System Log"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The system log contains detailed information about why a request was denied and other useful information."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"limits","__idx":35},"children":["Limits"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Scopes are unique per authorization server."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["audiences"]}," value you specify is an array of String. If the string contains \":\" it must be a valid URI."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Tokens can expire, be explicitly revoked at the endpoint, or implicitly revoked by a change in configuration."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Token revocation can be implicit in two ways: token expiration or a change to the source."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Expiration happens at different times:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["ID token expires after one hour."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access token expiration is configured in a policy, but is always between five minutes and one day."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Refresh token expiration depends on two factors:",{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Expiration is configured in an access policy, no limits, but must be greater than or equal to the access token lifetime"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Revocation if the refresh token isn't exercised within a specified time. Configure the specified time in an access policy, with a minimum of ten minutes."]}]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Revocation happens when a configuration is changed or deleted:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["User deactivation or deletion."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Configuration in the authorization server is changed or deleted."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://okta-help.pixtulate.com/okta_help.htm?id=ext_Apps_App_Integration_Wizard-oidc"},"children":["client app"]}," is deactivated, changed, unassigned, or deleted."]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"subtle-behavior","__idx":36},"children":["Subtle behavior"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Some behaviors aren't obvious:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A user must be assigned to the client in Okta for the client to get access tokens from that client. You can assign the client directly (direct user assignment) or indirectly (group assignment)."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you haven't created a rule in a policy on the authorization server to allow the client, user, and scope combination that you want, the request fails. To resolve, create at least one rule in a policy on the authorization server for the relevant resource that specifies client, user, and scope."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OpenID Connect scopes are granted by default, so if you are requesting only those scopes (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["openid"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["profile"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["address"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["phone"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]},"), you don't need to define any scopes for them, but you need a policy and rule on a Custom Authorization Server. The rule grants the OpenID Connect scopes by default, so they don't need to be configured in the rule. Token expiration times depend on how they are defined in the rules and which policies and rules match the request."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OpenID scopes can be requested with custom scopes. For example, a request can include ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["openid"]}," and a custom scope."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The evaluation of a policy always takes place during the initial authentication of the user (or of the client in case of the client credentials flow). If the flow isn't immediately finished, such as when a token is requested using the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authorization_code"]}," grant type, the policy isn't evaluated again, and a change in the policy after the user or client is initially authenticated won't affect the continued flow."]}]}]}]},"headings":[{"value":"OpenID Connect & OAuth 2.0","id":"openid-connect--oauth-20","depth":1},{"value":"Scopes","id":"scopes","depth":2},{"value":"Scope values","id":"scope-values","depth":3},{"value":"Scope properties","id":"scope-properties","depth":3},{"value":"Tokens and claims","id":"tokens-and-claims","depth":2},{"value":"Token lifetime","id":"token-lifetime","depth":3},{"value":"Claims","id":"claims","depth":3},{"value":"Access token","id":"access-token","depth":3},{"value":"Access token header","id":"access-token-header","depth":4},{"value":"Access token payload","id":"access-token-payload","depth":4},{"value":"Access token signature","id":"access-token-signature","depth":4},{"value":"Access token scopes and claims","id":"access-token-scopes-and-claims","depth":4},{"value":"Reserved scopes and claims","id":"reserved-scopes-and-claims","depth":5},{"value":"Reserved scopes","id":"reserved-scopes","depth":6},{"value":"Reserved claims in the header section","id":"reserved-claims-in-the-header-section","depth":6},{"value":"Reserved claims in the payload section","id":"reserved-claims-in-the-payload-section","depth":6},{"value":"Custom scopes and claims","id":"custom-scopes-and-claims","depth":5},{"value":"Custom scopes","id":"custom-scopes","depth":6},{"value":"Custom claims","id":"custom-claims","depth":6},{"value":"ID token","id":"id-token","depth":3},{"value":"ID token header","id":"id-token-header","depth":4},{"value":"ID token payload","id":"id-token-payload","depth":4},{"value":"ID token signature","id":"id-token-signature","depth":4},{"value":"ID token claims","id":"id-token-claims","depth":4},{"value":"Claims in the Header section","id":"claims-in-the-header-section","depth":5},{"value":"Claims in the Payload section","id":"claims-in-the-payload-section","depth":5},{"value":"Base claims (always present)","id":"base-claims-always-present","depth":6},{"value":"Scope-dependent claims (not always returned)","id":"scope-dependent-claims-not-always-returned","depth":6},{"value":"Refresh token","id":"refresh-token","depth":3},{"value":"JSON Web Key Set","id":"json-web-key-set","depth":2},{"value":"Key rotation","id":"key-rotation","depth":3},{"value":"Alternative validation","id":"alternative-validation","depth":3},{"value":"Best practices","id":"best-practices","depth":3},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Start with the System Log","id":"start-with-the-system-log","depth":3},{"value":"Limits","id":"limits","depth":3},{"value":"Subtle behavior","id":"subtle-behavior","depth":3}],"frontmatter":{"title":"OpenID Connect & OAuth 2.0","category":"authentication","excerpt":"Control user access to your applications.","meta":[{"name":"description","content":"Find information about the OAuth 2.0 and OpenID Connect endpoints that Okta exposes on its authorization servers."}],"seo":{"title":"OpenID Connect & OAuth 2.0"}},"lastModified":"2026-02-26T14:52:31.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/openapi/okta-oauth/guides/overview","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}