ktor-server-auth-oidc/io.ktor.server.auth.oidc/OidcToken

OidcToken

@SubclassOptInRequired(markerClass = [InternalKtorSubclassing::class])

Token material returned or validated by the OpenID Connect plugin.

This is the base type for all token-based principals in the OpenID Connect plugin. Use one of the concrete subclasses depending on the token source:

Id for full OpenID Connect flows with an ID token.
Access for JWT access tokens verified locally, for example, JWT Bearer authentication.
Introspected for access tokens validated via RFC 7662 introspection.

The plugin creates token instances after validation. Constructors for token-bearing subclasses are internal, so applications cannot accidentally fabricate a verified token principal.

Report a problem

Inheritors

Access

Introspected

Types

Access

@Serializable

@SerialName(value = "access_token")

class Access : OidcToken

Token principal from a JWT access token verified locally against this resource's OidcBearerConfig.audience.

@Serializable

@SerialName(value = "id_token")

class Id : OidcToken

Token principal from an OpenID Connect login containing a verified ID token plus the accompanying OAuth token material.

Introspected

@Serializable

@SerialName(value = "introspected_token")

class Introspected : OidcToken

Token principal from an access token validated via RFC 7662 introspection.

UserInfo

@Serializable

class UserInfo(val subject: String, val name: String? = null, val email: String? = null, val emailVerified: Boolean? = null, val picture: String? = null, val givenName: String? = null, val familyName: String? = null, val preferredUsername: String? = null)

Standard user claims extracted from an ID token payload, JWT access token payload, or UserInfo response.