# ID Token The [ID token](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) is provided as a signed JWT. The claims included in the ID token depend on the [scopes](https://docs.stoe.no/bankid-oidc-provider/core-concepts/scopes-and-claims.md) requested during authentication: ## Scoped information - The `openid` scope provides a basic ID token with minimal identity information - Adding the `profile` scope includes additional user information - The `nnin_altsub` scope can add Norwegian National Identity Number when needed and allowed When a permission is granted, the ID token will also include the [`permission_digest`](https://docs.stoe.no/bankid-oidc-provider/advanced-topics/authorization-details.md#id-token) claim, independent of the flow used to request it. ## Personal identifier > **Warning** > > - The `sub` claim is considered **unstable** identifier and might suddenly change for any user. > - It is recommended to use `bankid_altsub` as a stable user identifier. ## Structure The table below shows all possible claims in the ID token payload: | Claim | Description | Example | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | typ | Token type. Always ID for ID Tokens. | ID | | acr | Authentication Context Class Reference. Uniform Resource Name for IDP option being used, including Level of Assurance (LoA) | urn:bankid:bid;LOA=4 | | amr | Authentication Method Reference containing the factors involved in authentication. This value is a list of strings. Read more [here](https://docs.stoe.no/bankid-oidc-provider/core-concepts/identity-providers.md#supported-amr-values). | \["bid", "bid-mfa", "bid-app", "bid-pwd"] | | aud | Audience. Always client_id. | oidc_testclient | | azp | Authorized party. Equals client_id. | oidc_testclient | | bankid_altsub | BankID Personal Identifier (PID). Use this as a stable user identifier. | 9578-5999-4-1765512 | | originator | Name and Identifier of the BankID issuer. | CN=BankID Bankenes ID-tjeneste Bank CA 2, OU=988477052,O=Bankenes ID-tjeneste AS,\* C=NO;OrginatorId=9775; OriginatorName=Gjensidige Bank RA 1; OriginatorId=9775; | | exp | Expiration time in Epoch time. Corresponds to a forward session window after iat | 1510498063 | | iat | Issuing time in Epoch time equal to auth_time for new sessions. Is otherwise set at each session refresh. | 1510497763 | | iss | Issuer of the token. Always the OIDC Provider base URL. | | | jti | [Token identifier](https://tools.ietf.org/html/rfc7519#section-4.1.7). A unique identifier for the token. Can be used to prevent replay attacks. | 7f22fd6a-3d46-4d5a-ae56-6de3c53e1873 | | nonce | Cryptographically random and [non-guessable](https://datatracker.ietf.org/doc/html/rfc6749#section-10.10) string. This value ensures the integrity of the ID token and mitigates replay attacks. | 7f22fd6a-3d46-4d5a-ae56-6de3c53e1873 | | sub | Subject Identifier. GUID that identifies the end user across the different IDPs. This is considered an unstable identifier and might suddenly change for any user. It is recommended to use `bankid_altsub` as a stable user identifier. | e8c523ff-52a2-42e2-a7a5-f1d0fbb76204 | | updated_at | Update time. Epoch time of issuing / create / enrollment of eID in question. Replaces additionalCertInfo.certValidFrom. | 1468582440 | | sid | Session ID (reference) for the completed BankID authentication. This claim represents a unique BankID transaction. | 2e1eebb7-d5d7-4c55-9410-6ab178070a1c | | additionalCertInfo (Deprecated) | Additional information about the end user BankID certificate. Only applicable for certificate based eID (BankID High/LOA4). This claim is deprecated from API Version 4 and may be removed in the future. | { "certValidFrom": ..., "certValidTo":..., "serialNumber": ...} | | api_ver | The [version](https://docs.stoe.no/bankid-oidc-provider/api-versions.md) of the BankID API that was used. | 4 | | birthdate | Birthdate taken from associated BankID certificate | 1986-10-01 | | family_name | Surname (last name) from associated BankID certificate | Nordmann | | given_name | Given name (first name) from associated BankID certificate | Kari | | name | Full name from associated BankID certificate | Kari Nordmann | | permission_digest | SHA-256 hash of the permission statement. Present when [authorization_details](https://docs.stoe.no/bankid-oidc-provider/advanced-topics/authorization-details.md) is used. | x4Fz5C9hQq0m3LXKBA72WL8jKRXsQ6TnGiven3Gcz0k= | | nnin_altsub | Norwegian National Identity Number as alternate Subject Identifier. Available for Clients with legal basis to store this information. | 20902223127 | _Note: ID Tokens can be [verified](https://docs.stoe.no/bankid-oidc-provider/advanced-topics/verify-token.md) using standard JWT validation procedures._