All tokens in PingOne are JSON Web Tokens (JWTs) signed using the RS256 signing algorithm. The following section lists the supported claims for each token type.

Access token claims

For access tokens, the JWT header must contain the ID of the signing key as the kid claim.

Claim	Description
`sub`	A string that specifies the identifier for the authenticated user. This claim is not present for `client_credentials` tokens.
`client_id`	A string that specifies the application that requested this token.
`aud`	A string that lists the names of resources that this token is intended for. The resource of an application’s resource access grant is included if one or more scopes from the grant is requested and granted.
`scope`	A string that specifies the space-separated list of scope names associated with this token in the format described in Section 3.3 of OAuth 2.0 RFC6749.
`iss`	A string that specifies the per-environment issue URI: For example, `https://auth.pingone.com/<environmentId>/as`.
`iat`	An integer that specifies the timestamp, measured in the number of seconds since January 1, 1970, UTC, indicating when this token was originally issued, as defined in JWT RFC7519.
`exp`	An integer that specifies the timestamp, measured in the number of seconds since January 1, 1970, UTC, indicating when this token will expire, as defined in JWT RFC7519.
`sid`	A string that specifies the identifier for the user session. This claim is not present for `client_credentials` tokens.
`env`	A string that specifies the environment ID of the authenticated user or application. This claim is not present when the resource’s `audience` property does not include the PingOne platform API resource.
`org`	A string that specifies the organization ID of the authenticated user or application. This claim is not present when resource’s `audience` property does not include the PingOne platform API resource.

Claim

Description

sub

A string that specifies the identifier for the authenticated user. This claim is not present for client_credentials tokens.

client_id

A string that specifies the application that requested this token.

aud

A string that lists the names of resources that this token is intended for. The resource of an application’s resource access grant is included if one or more scopes from the grant is requested and granted.

scope

A string that specifies the space-separated list of scope names associated with this token in the format described in Section 3.3 of OAuth 2.0 RFC6749.

iss

A string that specifies the per-environment issue URI: For example, https://auth.pingone.com/<environmentId>/as.

iat

An integer that specifies the timestamp, measured in the number of seconds since January 1, 1970, UTC, indicating when this token was originally issued, as defined in JWT RFC7519.

exp

An integer that specifies the timestamp, measured in the number of seconds since January 1, 1970, UTC, indicating when this token will expire, as defined in JWT RFC7519.

sid

A string that specifies the identifier for the user session. This claim is not present for client_credentials tokens.

env

A string that specifies the environment ID of the authenticated user or application. This claim is not present when the resource’s audience property does not include the PingOne platform API resource.

org

A string that specifies the organization ID of the authenticated user or application. This claim is not present when resource’s audience property does not include the PingOne platform API resource.

ID Token claims

ID tokens are signed with the same key as the access token. The JWT header must contain the ID of the signing key as the kid claim.

Claim	Description
`sub`	A string that specifies the identifier for the authenticated user.
`aud`	A string that lists the names of resources that this token is intended for. The resource of an application’s resource access grant is included if one or more scopes from the grant is requested and granted.
`iss`	A string that specifies the per-environment issuer URI: `https://auth.pingone.com/<environmentId>/as` or `https://<customDomain>/as`.
`iat`	An integer that specifies the timestamp, measured in the number of seconds since January 1, 1970, UTC, indicating when this token was originally issued, as defined in JWT RFC7519.
`exp`	An integer that specifies the timestamp, measured in the number of seconds since January 1, 1970, UTC, indicating when this token will expire, as defined in JWT RFC7519.
`sid`	A string that specifies the identifier for the user session.
`auth_time`	A string that specifies the time when the user authentication occurred. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the current date and time.
`nonce`	A string that specifies the value used to associate a client session with an `id_token`, and to mitigate replay attacks. The value is passed through unmodified from the authentication request to the ID token.
`at_hash`	A case-sensitive string that specifies the access token hash value, which is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the access token value. For more information, see OpenID Connect Core 1.0.
`c_hash`	A case-sensitive string that specifies the code hash value, which is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the code value. For more information, see OpenID Connect Core 1.0.
`acr`	A string that specifies the name of the sign-on policy that was completed when the original authentication was performed. This claim is present only if an ID token was minted.
`amr`	A string array that specifies the methods associated with the authenticators used when the original authentication was performed. This claim is present only if an ID token was minted.

Claim

Description

sub

A string that specifies the identifier for the authenticated user.

aud

iss

A string that specifies the per-environment issuer URI: https://auth.pingone.com/<environmentId>/as or https://<customDomain>/as.

iat

An integer that specifies the timestamp, measured in the number of seconds since January 1, 1970, UTC, indicating when this token was originally issued, as defined in JWT RFC7519.

exp

An integer that specifies the timestamp, measured in the number of seconds since January 1, 1970, UTC, indicating when this token will expire, as defined in JWT RFC7519.

sid

A string that specifies the identifier for the user session.

auth_time

A string that specifies the time when the user authentication occurred. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the current date and time.

nonce

A string that specifies the value used to associate a client session with an id_token, and to mitigate replay attacks. The value is passed through unmodified from the authentication request to the ID token.

at_hash

A case-sensitive string that specifies the access token hash value, which is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the access token value. For more information, see OpenID Connect Core 1.0.

c_hash

A case-sensitive string that specifies the code hash value, which is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the code value. For more information, see OpenID Connect Core 1.0.

acr

A string that specifies the name of the sign-on policy that was completed when the original authentication was performed. This claim is present only if an ID token was minted.

amr

A string array that specifies the methods associated with the authenticators used when the original authentication was performed. This claim is present only if an ID token was minted.

Note: Standard OpenID Connect scopes can be specified in an authorization request to control which user claims are included in an id_token or in a userinfo response. For more information about OIDC scopes and their associated user claims, see OpenID Connect (OIDC) scopes.

Access token claims

ID Token claims

Refresh tokens