| Scope |
Claims |
Notes |
openid |
sub |
Required. The person’s KT Accounts ID |
profile |
name, preferred_username, picture |
preferred_username is the handle, left out when the person has none |
email |
email, email_verified |
Only when the account has a verified address and the person ticks it on the consent screen |
permissions |
permissions, is_owner |
The person’s permissions, including the role.<badge> ones, and whether they are Aiden |
| Claim |
|
iss |
https://accounts.aidenkt.com |
sub |
The person’s KT Accounts ID |
aud, azp |
Your client ID |
iat, exp |
Issued at, and one hour later |
auth_time |
When the person signed in |
nonce |
The one you sent |
| Scope claims |
As in the table above |
Signed with ES256 by a key in /oauth/jwks.json.
| Path |
Sees |
Kit and /api/whoami |
The signed-in person’s ID, name, handle, picture, banner, permissions, badges and apps. Never an email address |
openid |
The person’s KT Accounts ID |
profile |
Name, handle and picture |
email |
The email address, only when verified and allowed by the person |
permissions |
Permissions with role permissions, and is_owner |
No path ever gives out a sign-in method, a session, a token of another app, or another app’s data.
