OpenID Connect Claims

sub (subject) is the stable, unique identifier for the user within the issuer. It is the canonical user ID in OIDC. Always use sub (not email) as the primary user identifier in your database – emails can change, sub never changes for a given user at a given provider.

iss (issuer) is the URL of the identity provider that issued the ID Token. Clients MUST verify the iss claim matches the expected provider URL. This prevents token confusion attacks where a token from one provider is used at another.

aud (audience) contains the client_id(s) that the ID Token is intended for. Clients MUST reject tokens where their client_id is not in aud. This prevents a token obtained for application A from being used at application B.

exp (expiration time) is the Unix timestamp after which the ID Token MUST NOT be accepted. Clients MUST verify the current time is before exp. ID Tokens are typically valid for 1 hour. Always validate exp – accepting expired tokens is a security vulnerability.

iat (issued at) is the Unix timestamp when the ID Token was issued. Used for token freshness checks and audit logging. The difference between exp and iat is the token's intended lifetime.

nonce is an anti-replay value sent in the authorization request and embedded in the ID Token. Clients that include a nonce in the authorization request MUST verify the nonce in the ID Token matches. This prevents replay attacks where an attacker reuses a valid ID Token.

email is the user's preferred email address. Available when the 'email' scope is requested. Always check email_verified before trusting the email for authentication decisions – an unverified email could be a different person's address.

name is the user's full display name. Available when the 'profile' scope is requested. The profile scope also includes given_name, family_name, middle_name, nickname, preferred_username, profile, picture, website, gender, birthdate, zoneinfo, locale, updated_at.