iss
requiredscope: openid (required)Type: string (URL, https://)
iss (issuer) is the URL of the identity provider that issued the ID Token. Clients MUST verify the iss claim matches the expected provider URL. This prevents token confusion attacks where a token from one provider is used at another.
Details
The iss claim identifies which identity provider issued the ID Token.
Validation requirement: every client MUST verify that iss exactly matches the expected issuer before trusting any other claims in the token. Accepting tokens from unexpected issuers is a critical security vulnerability.
Iss format: a URL (scheme + authority + optional path). Google: 'https://accounts.google.com'. Apple: 'https://appleid.apple.com'.
Iss is available from the discovery document: the iss value in the discovery document (/.well-known/openid-configuration) MUST match the issuer URL of that document. Clients can auto-configure by fetching discovery.
Multiple issuers: if your application accepts tokens from multiple identity providers (Google AND GitHub), validate iss before validating other claims. Route to the correct validation logic based on iss.
Example Values
| Label | Value |
|---|---|
| "https://accounts.google.com" | |
| Apple | "https://appleid.apple.com" |
| Auth0 | "https://your-tenant.auth0.com/" |
| Keycloak | "https://keycloak.example.com/realms/myrealm" |
Validation Rules
MUST be present in every ID Token
Client MUST verify iss exactly matches the expected issuer URL
MUST use https:// scheme
MUST NOT have query string or fragment components