Scopes & claims

Scopes

Scope	Description
`openid`	OIDC — required for ID token issuance
`profile`	Display name and avatar
`email`	Email address

Request scopes as a space-separated list:

scope=openid profile email

Only scopes allowed for your client (set in Developer Portal) are granted.

GET /oauth/userinfo with Authorization: Bearer ACCESS_TOKEN returns:

Claim	Scope	Description
`sub`	`openid`	Stable user ID
`name`	`profile`	Display name
`picture`	`profile`	Avatar URL
`email`	`email`	Email address
`email_verified`	`email`	Always `true` for OakID accounts

The token response includes an id_token (JWT, HS256). Validate iss, aud (your client_id), and exp before trusting claims.