Skip to main content

OAuth and OIDC examples and tokens

This page contains practical OAuth and OIDC examples, including end-to-end flow summaries, token sets, and sample token payloads.

Configuring OIDC applications​

To configure OIDC applications in IDaaS, see the instructions for your application type:

These guides provide step-by-step configuration instructions for authentication methods, token signing, scopes, redirect URIs, and other OIDC settings.

Example flows​

OAuth authorization code flow​

  1. User signs in and is redirected to the Authorization Server.
  2. Authorization Server authenticates (passwordless, passkey, etc.).
  3. User grants consent to the client.
  4. Client receives an authorization code.
  5. Client exchanges it for an Access Token.
  6. Client uses Access Token to access resource server APIs.

OIDC authorization code flow​

  1. User signs in and is redirected to the Authorization Server.
  2. Authorization Server authenticates (passwordless, passkey, etc.).
  3. User grants consent to the client.
  4. Client receives an authorization code.
  5. Client exchanges it for an Access Token and ID Token.
  6. Client validates ID Token.
  7. Client uses Access Token to access UserInfo Endpoint APIs.

OAuth/OIDC authorization code flow​

  1. User signs in and is redirected to the Authorization Server.
  2. Authorization Server authenticates (passwordless, passkey, etc.).
  3. User grants consent to the client.
  4. Client receives an authorization code.
  5. Client exchanges it for an Access Token and ID Token.
  6. Client validates ID Token.
  7. Client uses Access Token to access resource server APIs.

Example response token sets​

OAuth​

{
  "access_token": "eyWkr0i3pck...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "def50200a1..."
}

The access token is a JWT token used to access a resource server.

OIDC​

{
  "access_token": "u3pgnmeis03r...",
  "id_token": "eyJraWQiOiJ...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "def50200a1..."
}

The access token is a JWT token used to access a resource server. The id token is a JWT token used to identify the authenticated user.

OAuth/OIDC​

{
  "access_token": "eyWkr0i3pck...",
  "id_token": "eyJraWQiOiJ...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "def50200a1..."
}

The access token is a JWT token used to access a resource server. The id token is a JWT token used to identify the authenticated user.

Example tokens​

OAuth/OIDC ID token​

{
  "x5t": "mtMXOuqGEWrLh7YURswUhOPs6CI",
  "kid": "200706313",
  "typ": "JWT",
  "alg": "RS256"
}

Payload​

{
  "jti": "3bb2e670-f5a5-477c-87e0-5d2841bcaad4",
  "nonce": "k3ao4pwi302vsijf",
  "sub": "user1",
  "iss": "https://example.us.trustedauth.com/api/oidc",
  "aud": "fcd612d3-79e6-4702-ba9d-90575125394f",
  "iat": 1763664566,
  "nbf": 1763664566,
  "exp": 1763668166,
  "locale": "en",
  "tid": "3a4a1be8-3989-42b2-931b-deed82536152",
  "auth_time": 1763664558,
  "acr": "urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken",
  "amr": ["OTP", "otp", "sms", "pop"],
  "authenticators": ["NONE:OTP"],
  "email": "user.one@example.com",
  "given_name": "User",
  "family_name": "One",
  "name": "User One",
  "nickname": "User1",
  "groups_unique": [
    "2e90e388-f368-40e5-ab5a-2cf3c650eaa0",
    "7aa381e6-6834-4e66-b985-3ced99dad2cf"
  ],
  "groups": ["Auditor", "Help Desk"],
  "favorite_color": "Blue"
}

OAuth/OIDC access token​

Header​

{
  "x5t": "mtMXOuqGEWrLh7YURswUhOPs6CI",
  "kid": "200706313",
  "typ": "at+JWT",
  "alg": "RS256"
}

Payload (lite)​

The configuration for this access token has been enabled to include minimal user information and additional authorization server information in the token.

{
  "jti": "2e6fc675-8983-413e-b52b-dc1b629f8575",
  "sub": "user1",
  "iss": "https://example.us.trustedauth.com/api/oidc",
  "aud": "https://demo.com/marketplace",
  "iat": 1763664566,
  "nbf": 1763664566,
  "exp": 1763664626,
  "cid": "fcd612d3-79e6-4702-ba9d-90575125394f",
  "scope": "view:tests view:claims view:flights view:profile view:visits fill:claims post:visits"
}

Payload (full)​

note

The configuration for this access token has been enabled to include all user information as well as additional authorization server information in the token.

{
  "jti": "2e6fc675-8983-413e-b52b-dc1b629f8575",
  "sub": "user1",
  "iss": "https://example.us.trustedauth.com/api/oidc",
  "aud": "https://demo.com/marketplace",
  "iat": 1763664566,
  "nbf": 1763664566,
  "exp": 1763664626,
  "locale": "en",
  "tid": "3a4a1be8-3989-42b2-931b-deed82536152",
  "cid": "fcd612d3-79e6-4702-ba9d-90575125394f",
  "app": "Client Engagement",
  "auth_time": 1763664558,
  "acr": "urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken",
  "amr": ["OTP", "otp", "sms", "pop"],
  "authenticators": ["NONE:OTP"],
  "scope": "view:tests view:claims view:flights view:profile view:visits fill:claims post:visits",
  "email": "user.one@example.com",
  "given_name": "User",
  "family_name": "One",
  "name": "User One",
  "nickname": "User1",
  "groups_unique": [
    "2e90e388-f368-40e5-ab5a-2cf3c650eaa0",
    "7aa381e6-6834-4e66-b985-3ced99dad2cf"
  ],
  "groups": ["Auditor", "Help Desk"],
  "favorite_color": "Blue"
}

For token validation requirements, see OAuth and OIDC token validation and best practices.