OpenID Connect

To receive an id_token in the token response, the openid scope must be included in the authorization request OIDC Core §3.1.2.1. Without it, the token response contains only access_token and refresh_token.

You can include openid in your scope parameter when redirecting users to the authorization endpoint, as per the standard. We also require you to set it as the default scope in your developer area (Manage developer settings → Credentials → Scopes). That way we know to include the id_token when users launch your app from their dashboards (IdP-initiated flows), where the client does not specify scopes.

The nonce associates your session with the id_token and mitigates replay attacks OIDC Core §3.1.2.1. It is optional in the authorization code flow, but recommended. Send it as a URL parameter on the authorization endpoint.

Generate a fresh value per authorization request, store it against the user's session, and include it as the nonce URL parameter when redirecting to the authorization endpoint. It is treated as a case-sensitive string.

Use a cryptographically secure random value. Sufficient entropy must be present so that the value cannot be guessed OIDC Core §3.1.2.1. This is your responsibility as the client: we pass the value through unmodified and cannot verify how it was generated. At least 32 bytes of randomness is recommended; do not use timestamps, counters, or user identifiers. For example, bin2hex(random_bytes(32)) in PHP or crypto.randomBytes(32).toString('hex') in Node.

Binding the value to the browser session strengthens this further: store a cryptographically random value in an HttpOnly session cookie (or local storage for browser-based clients) and send a cryptographic hash of it as the nonce, then compare the returned claim against the hash of the stored value OIDC Core §15.5.2.

Percent-encode the value when adding it to the query string, as with every other authorization request parameter OIDC Core §13.1. We compare and return the decoded value, so a hex or base64url nonce needs no special handling.

We accept up to 1024 characters, which is well beyond what a securely generated value requires.

We return it unmodified as the nonce claim in the ID token. You must verify it matches the value you sent, and reject the token if it does not OIDC Core §3.1.3.7. If you did not send a nonce, the claim is omitted.

{
  "issuer": "https://app.mylogin.com",
  "authorization_endpoint": "https://app.mylogin.com/oauth/authorize",
  "token_endpoint": "https://app.mylogin.com/oauth/token",
  "jwks_uri": "https://app.mylogin.com/.well-known/jwks.json",
  "scopes_supported": ["openid"],
  "response_types_supported": ["code", "id_token"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["RS256"],
  "token_endpoint_auth_methods_supported": ["client_secret_basic"],
  "claims_supported": ["email", "given_name", "family_name", "nonce", "https://app.mylogin.com/claims/google_email", "https://app.mylogin.com/claims/microsoft_email", "https://app.mylogin.com/claims/wonde_id"],
  "service_documentation": "https://app.mylogin.com/developer/docs/oidc"
}

// JWT = base64url(header).base64url(payload).base64url(signature)
// Decode header and payload (base64url → base64, then decode)
$parts = explode('.', $rawToken);
$base64urlDecode = function (string $str): string {
$decoded = base64_decode(strtr($str, '-_', '+/'));
return $decoded !== false ? $decoded : '';
};
$header = json_decode($base64urlDecode($parts[0]));
$payload = json_decode($base64urlDecode($parts[1]));
// For production: verify the signature using the public key from JWKS
// e.g. Firebase\JWT\JWT::decode($rawToken, new Key($publicKey, 'RS256'))

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "01kkh1der1aw0en5ysyzcmvy9m"
}

{
  "iss": "https://app.mylogin.com",
  "sub": "A1414141414",
  "aud": "the-fellowship",
  "exp": 1734567890,
  "iat": 1734534290,
  "nonce": "n-0S6_WzA2Mj",
  "email": "frodo@bagend.shire",
  "given_name": "Frodo",
  "family_name": "Baggins",
  "type": "student",
  "https://app.mylogin.com/claims/wonde_id": "B1234567"
}