# Access Token ## Structure The [access token](https://tools.ietf.org/html/rfc6749#section-1.4) is a self-contained JWT that includes: - `iss` - Token issuer - `azp` - Authorized party - `sub` - Subject identifier (use `bankid_altsub` for a stable user identifier when applicable) - `aud` - Intended audience (resource servers) - `resource_access` - scope and access details based on the requested [scopes](https://docs.stoe.no/bankid-oidc-provider/core-concepts/scopes-and-claims.md) - `authorization_details` - (conditional) present when [authorization_details](https://docs.stoe.no/bankid-oidc-provider/advanced-topics/authorization-details.md) was included in the PAR request Access tokens can be validated using the [introspect](https://docs.stoe.no/bankid-oidc-provider/api/introspect.md) endpoint. > **Client Credential tokens** > > Access tokens for the [Client Credential Grant](https://docs.stoe.no/bankid-oidc-provider/api/token.md#client-credentials) have a different structure since there is no ID Token involved. ## Claims | Claim | Example | Description | | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | typ | Bearer | Token type. Always Bearer for Access Tokens. | | allowed-origins | \[] | Not in use by the OIDC Provider from BankID | | acr | urn:bankid:bid;LOA=4 | | | amr Authentication Context Class Reference. Uniform Resource Name for IDP option being used, including Level of Assurance (LoA) | \["bid", "bid-mfa", "bid-app", "bid-pwd"] | Authentication Method Reference containing the factors involved in authentication. This value is a list of strings. Read more [here](https://docs.stoe.no/bankid-oidc-provider/core-concepts/identity-providers.md#supported-amr-values). | | azp | oidc_testclient | Authorized party. Equals your client_id. | | bankid_altsub | 9578-5999-4-1765512 | BankID Personal Identifier (PID). Use this as a stable user identifier. | | exp | 1510498063 | Expiration time in Epoch time. Corresponds to a forward session window after iat | | iat | 1510497763 | Issuing time in Epoch time equal to auth_time for new sessions. Is otherwise set at each session refresh. | | iss | | Issuer of the token. Always the OIDC Provider base URL. | | jti | 7f22fd6a-3d46-4d5a-ae56-6de3c53e1873 | [Token identifier](https://tools.ietf.org/html/rfc7519#section-4.1.7). A unique identifier for the token. Can be used to prevent replay attacks. | | nonce | 7f22fd6a-3d46-4d5a-ae56-6de3c53e1873 | Cryptographically random and [non-guessable](https://datatracker.ietf.org/doc/html/rfc6749#section-10.10) string. This value ensures the integrity of the ID token and mitigates replay attacks. | | sid | 2e1eebb7-d5d7-4c55-9410-6ab178070a1c | Session ID (reference) for the completed BankID authentication. This claim represents a unique BankID transaction. | | sub | e8c523ff-52a2-42e2-a7a5-f1d0fbb76204 | Subject Identifier. GUID that identifies the end user across the different IDPs. This is considered an unstable identifier and might suddenly change for any user. It is recommended to use `bankid_altsub` as a stable user identifier. | | birthdate | 1986-10-01 | Birthdate taken from associated BankID certificate | | family_name | Nordmann | Surname (last name) from associated BankID certificate | | given_name | Kari | Given name (first name) from associated BankID certificate | | name | Kari Nordmann | Full name from associated BankID certificate | | preferred_username | Nordmann, Kari | Equal to name. | | api_ver | 4 | Which API version the access token is issued for. See [API Versions](https://docs.stoe.no/bankid-oidc-provider/api-versions.md). | | aud | tinfo | The intended recipient of the access token, which is the client application (OIDC Client) that requested it. | | realm_access (Deprecated) | "roles": \[] | **(deprecated)** Resource access designator at the OIDC platform level. Will be removed in the future. | | resource_access | {"tinfo": {"roles": \["address","phone_number", "email", "nnin"]}} | Resource access designator. | | authorization_details | \[{"type": "payment.v1", "permission": "eyJub25jZS4uLn0", "permission_digest": "x4Fz5C9hQq0m3LXKBA72WL8jKRXsQ6TnGiven3Gcz0k="}] | Authorization detail objects with permission digest. Present when [authorization_details](https://docs.stoe.no/bankid-oidc-provider/advanced-topics/authorization-details.md) is used. | ## Examples ### Access token for electronic signing The following is an example of a valid access token for the SignDoc resource server. The resource designator `signdoc` as well as the role `read_write` is added to the `resource_access` claim of the access token to grant access to the associated endpoint of the SignDoc [resource server](https://docs.stoe.no/bankid-oidc-provider/core-concepts/resource-server.md) API. ```json { "exp": 1629281602, "iat": 1629281302, "jti": "7cc03090-7c8b-4775-9532-51169932adc7", "iss": "https://auth.current.bankid.no/auth/realms/current", "aud": "signdoc", "sub": "b9ce6414-2ddc-46e2-8330-7f3d59000c64", "typ": "Bearer", "azp": "oidc-testclient", "acr": "1", "realm_access": { "roles": [] }, "resource_access": { "signdoc": { "roles": [ "read_write" ] } }, "scope": "signdoc/read_write", "clientHost": "xxx.xxx.xxx.xx", "clientId": "oidc-testclient", "resource_claims": {}, "clientAddress": "xxx.xxx.xxx.xx" } ``` ### Access token for access to userinfo Below is an example of a valid Access Token for access to the [Userinfo](https://docs.stoe.no/bankid-oidc-provider/core-concepts/resource-server.md), used in context of the [userinfo](https://docs.stoe.no/bankid-oidc-provider/api/userinfo.md) API. The resource designator`tinfo`is added to the`resource_access`claim of the access token to grant access to Userinfo. ```json { "sub": "2cd7cecd-d444-4685-bb04-8bbfdb45a069", "resource_access" : { "tinfo" : { "roles" : [ "address", "phone", "nnin", "profile", "email" ] } }, "birthdate": "2018-05-09", "amr": ["bid", "bid-mfa", "bid-app", "bid-pwd"], "iss": "https://auth.current.bankid.no/auth/realms/current", "typ": "Bearer", "bankid_altsub": "9578-6000-4-634582", "originator": "CN=BankID - TestBank1 - Bank CA 3,OU=123456789,O=TestBank1 AS,C=NO;OrginatorId=9980;OriginatorName=BINAS;OriginatorId=9980", "given_name": "Test User", "nonce": "a6c03ff5-936c-4bff-ab98-a9898d37984f", "aud": "tinfo", "acr": "urn:bankid:bid;LOA=4", "realm_access": { "roles": [] }, "azp": "oidc-testclient", "auth_time": 1629280890, "scope": "openid phone address profile email", "resource_claims": { }, "name": "Test User BankID", "exp": 1629281190, "session_state": "66801cef-7746-4dd6-a018-43bda5c7002b", "iat": 1629280890, "api_ver" : 2, "family_name": "BankID", "jti": "2fc59b32-e1ed-47cb-abf7-87786504912a" } ```