# Deprecations

This is a list of the active deprecation warnings in BankID along with end of life dates.

Please review this list regularly to ensure your systems are up to date in order to avoid any service interruptions.

## Introspection without `token_type_hint`

**Deprecated**: 18 Sep 2026
**End of Life**: To be announced

The [Introspection endpoint](https://docs.stoe.no/bankid-oidc-provider/api/introspect.md) requires `token_type_hint=bid_access_token`, although [RFC 7662 section 2.1](https://tools.ietf.org/html/rfc7662#section-2.1) defines this parameter as optional. This BankID-specific requirement will be enforced in a future update.

Once enforced, a request with no `token_type_hint`, or with any other value, returns HTTP `200` with a body of `{"active": false}`, even when the Access Token is valid.

Under [RFC 7662 section 2.2](https://tools.ietf.org/html/rfc7662#section-2.2), an authorized introspection request also returns `{"active": false}` when the caller cannot introspect that particular token. The response does not distinguish this case from an expired or revoked token.

Please ensure your introspection calls include `token_type_hint=bid_access_token`.

## Enforcement of API version 4

**Notice**: 07 Apr 2025

**Enforcement**: Oct 2025

API version 4 will be enforced for all clients. See also [special announcement](https://docs.stoe.no/bankid-oidc-provider/important-updates-04-2025.md)

Please ensure your integration is compatible with the changes specified on the [API Version](https://docs.stoe.no/bankid-oidc-provider/api-versions.md) page.

You can opt-in to use API version 4 already,
please see the [API Version](https://docs.stoe.no/bankid-oidc-provider/api-versions.md) page for more information.

## Deprecation of custom logo

**Deprecated**: 15 Jan 2025

As part of harmonizing the user experience across all BankID clients, the custom logo feature is removed from
the BankID authentication flows.

## Removal of jwks_uri_enc and encryption of login_hint

**Deprecated**: 01 Sep 2022

**End of Life**: 2024

The [encryption](https://docs.stoe.no/bankid-oidc-provider/core-concepts/encrypted-request-object.md) of `login_hint` is replaced
with the OIDC standard encryption of a `request` object.

Instead of encrypting the [login_hint](https://docs.stoe.no/bankid-oidc-provider/api/authorize.md) using keys from the `jwks_uri_enc` endpoint,
the [login_hint](https://docs.stoe.no/bankid-oidc-provider/api/authorize.md) should be added as a cleartext parameter to the `request` object
and the `request` objects should be encrypted using keys from the `jwks_uri` endpoint.

See details about [encryption](https://docs.stoe.no/bankid-oidc-provider/core-concepts/encrypted-request-object.md).

## Lowercased token_type in Token response

**Deprecated**: 15 Feb 2022

**API Version**: From version 3

The token response claim `token_type` has wrongly been lowercased `bearer`. This is being corrected to `Bearer`
as per the standard.

You can opt-in to use [API Version](https://docs.stoe.no/bankid-oidc-provider/api-versions.md) 3 to get the correct `token_type` value.

Make sure your system can handle capitalized `token_type` in the Token response. For example,
some openid client libraries use this value later for Authorization etc.

## Token claim session_state is being replaced by sid

**Deprecated**: 15 Feb 2022

**End of Life**: 2025

Today, all tokens will have both sid and `session_state` claims representing the same value
(GUID related to [session handling](https://docs.stoe.no/bankid-oidc-provider/core-concepts/session-handling.md)).

`session_state` will soon be removed from all tokens so make sure you do not depend on this claim.
Use sid claim if you depend on this value.