> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# OAuth and OIDC examples and tokens

This page contains practical OAuth and OIDC examples, including end-to-end flow summaries, token sets, and sample token payloads.

## Configuring OIDC applications

To configure OIDC applications in IDaaS, see the instructions for your application type:

- [Web applications](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/integrate-a-generic-oidc-and-oauth-web-application.md)
- [Server/backend applications](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/integrate-a-generic-oidc-and-oauth-server-application.md)
- [Embedded applications](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/integrate-a-generic-oidc-and-oauth-embedded-application.md)

These guides provide step-by-step configuration instructions for authentication methods, token signing, scopes, redirect URIs, and other OIDC settings.

---

## Example flows

### OAuth authorization code flow

1. **User signs in** and is redirected to the Authorization Server.
2. **Authorization Server authenticates** (passwordless, passkey, etc.).
3. User **grants consent** to the client.
4. Client receives an **authorization code**.
5. Client exchanges it for an **Access Token**.
6. Client uses **Access Token** to access resource server APIs.

### OIDC authorization code flow

1. **User signs in** and is redirected to the Authorization Server.
2. **Authorization Server authenticates** (passwordless, passkey, etc.).
3. User **grants consent** to the client.
4. Client receives an **authorization code**.
5. Client exchanges it for an **Access Token** and **ID Token**.
6. Client validates **ID Token**.
7. Client uses **Access Token** to access UserInfo Endpoint APIs.

### OAuth/OIDC authorization code flow

1. **User signs in** and is redirected to the Authorization Server.
2. **Authorization Server authenticates** (passwordless, passkey, etc.).
3. User **grants consent** to the client.
4. Client receives an **authorization code**.
5. Client exchanges it for an **Access Token** and **ID Token**.
6. Client validates **ID Token**.
7. Client uses **Access Token** to access resource server APIs.

---

## Example response token sets

### OAuth

```json
{
  "access_token": "eyWkr0i3pck...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "def50200a1..."
}
```

The access token is a JWT token used to access a resource server.

### OIDC

```json
{
  "access_token": "u3pgnmeis03r...",
  "id_token": "eyJraWQiOiJ...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "def50200a1..."
}
```

The access token is a JWT token used to access a resource server. The id token is a JWT token used to identify the authenticated user.

### OAuth/OIDC

```json
{
  "access_token": "eyWkr0i3pck...",
  "id_token": "eyJraWQiOiJ...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "def50200a1..."
}
```

The access token is a JWT token used to access a resource server. The id token is a JWT token used to identify the authenticated user.

---

## Example tokens

### OAuth/OIDC ID token

#### Header

```json
{
  "x5t": "mtMXOuqGEWrLh7YURswUhOPs6CI",
  "kid": "200706313",
  "typ": "JWT",
  "alg": "RS256"
}
```

#### Payload

```json
{
  "jti": "3bb2e670-f5a5-477c-87e0-5d2841bcaad4",
  "nonce": "k3ao4pwi302vsijf",
  "sub": "user1",
  "iss": "https://example.us.trustedauth.com/api/oidc",
  "aud": "fcd612d3-79e6-4702-ba9d-90575125394f",
  "iat": 1763664566,
  "nbf": 1763664566,
  "exp": 1763668166,
  "locale": "en",
  "tid": "3a4a1be8-3989-42b2-931b-deed82536152",
  "auth_time": 1763664558,
  "acr": "urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken",
  "amr": ["OTP", "otp", "sms", "pop"],
  "authenticators": ["NONE:OTP"],
  "email": "user.one@example.com",
  "given_name": "User",
  "family_name": "One",
  "name": "User One",
  "nickname": "User1",
  "groups_unique": [
    "2e90e388-f368-40e5-ab5a-2cf3c650eaa0",
    "7aa381e6-6834-4e66-b985-3ced99dad2cf"
  ],
  "groups": ["Auditor", "Help Desk"],
  "favorite_color": "Blue"
}
```

### OAuth/OIDC access token

#### Header

```json
{
  "x5t": "mtMXOuqGEWrLh7YURswUhOPs6CI",
  "kid": "200706313",
  "typ": "at+JWT",
  "alg": "RS256"
}
```

#### Payload (lite)

The configuration for this access token has been enabled to include minimal user information and additional authorization server information in the token.

```json
{
  "jti": "2e6fc675-8983-413e-b52b-dc1b629f8575",
  "sub": "user1",
  "iss": "https://example.us.trustedauth.com/api/oidc",
  "aud": "https://demo.com/marketplace",
  "iat": 1763664566,
  "nbf": 1763664566,
  "exp": 1763664626,
  "cid": "fcd612d3-79e6-4702-ba9d-90575125394f",
  "scope": "view:tests view:claims view:flights view:profile view:visits fill:claims post:visits"
}
```

#### Payload (full)

note

The configuration for this access token has been enabled to include all user information as well as additional authorization server information in the token.

```json
{
  "jti": "2e6fc675-8983-413e-b52b-dc1b629f8575",
  "sub": "user1",
  "iss": "https://example.us.trustedauth.com/api/oidc",
  "aud": "https://demo.com/marketplace",
  "iat": 1763664566,
  "nbf": 1763664566,
  "exp": 1763664626,
  "locale": "en",
  "tid": "3a4a1be8-3989-42b2-931b-deed82536152",
  "cid": "fcd612d3-79e6-4702-ba9d-90575125394f",
  "app": "Client Engagement",
  "auth_time": 1763664558,
  "acr": "urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken",
  "amr": ["OTP", "otp", "sms", "pop"],
  "authenticators": ["NONE:OTP"],
  "scope": "view:tests view:claims view:flights view:profile view:visits fill:claims post:visits",
  "email": "user.one@example.com",
  "given_name": "User",
  "family_name": "One",
  "name": "User One",
  "nickname": "User1",
  "groups_unique": [
    "2e90e388-f368-40e5-ab5a-2cf3c650eaa0",
    "7aa381e6-6834-4e66-b985-3ced99dad2cf"
  ],
  "groups": ["Auditor", "Help Desk"],
  "favorite_color": "Blue"
}
```

## Related topics

For token validation requirements, see [OAuth and OIDC token validation and best practices](/docs/applications-and-sso/oidc/oauth-oidc-foundations/oauth-oidc-token-validation-and-best-practices.md).