Okta OIDC Bearer Tokens Reserved Claims List
Last Updated:
API Access Management
Okta Classic Engine
Okta Identity Engine
Overview
Specifying, adding, or modifying certain claim names on a custom authorization server or via a token inline hook for OpenID Connect (OIDC) bearer tokens results in an error. Okta defines specific reserved claims that cannot be overridden. Administrators must use non-reserved claim names when configuring custom claims to prevent conflicts with Okta system claims.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- API Access Management
- Custom Claims
- Token Inline Hooks
Cause
Okta defines specific reserved claims that cannot be overridden.
Solution
Which claims are reserved by Okta?
The following reserved claims are unusable when adding a custom claim to a token or modifying an existing claim.
| Claim Name | Token Type |
|---|---|
| acr | Access Token |
| amr | Access Token |
| as_uri | Access Token |
| cid | Access Token |
| groups | Access Token |
| rpt | Access Token |
| rsi | Access Token |
| uid | Access Token |
| username | Access Token |
| active | ID Token |
| aid | ID Token |
| aud | ID Token |
| app_id | ID Token |
| app_type | ID Token |
| at_hash | ID Token |
| auth_time | ID Token |
| client_id | ID Token |
| client_ip | ID Token |
| client_req_id | ID Token |
| client_type | ID Token |
| client_user_agent | ID Token |
| cnf | ID Token |
| c_hash | ID Token |
| device_compliance | ID Token |
| device_id | ID Token |
| device_known | ID Token |
| device_managed | ID Token |
| device_name | ID Token |
| device_trust | ID Token |
| did | ID Token |
| dst | ID Token |
| group | ID Token |
| hotk | ID Token |
| idp | ID Token |
| idp_iss | ID Token |
| mac_key | ID Token |
| may_act | ID Token |
| nonce | ID Token |
| oid | ID Token |
| okta_emailVerified | ID Token |
| okta_lastUpdated | ID Token |
| orig | ID Token |
| permissions | ID Token |
| purpose | ID Token |
| pwd_exp_days | ID Token |
| pwd_exp_time | ID Token |
| rid | ID Token |
| role | ID Token |
| scope | ID Token |
| scopes | ID Token |
| sid | ID Token |
| sub | ID Token |
| term | ID Token |
| user_ip | ID Token |
| iss | Access Token & ID Token |
| jti | Access Token & ID Token |
| token_type | Access Token & ID Token |
| ver | Access Token & ID Token |
Scope-dependent claims for ID tokens have additional restrictions.
The following scope-dependent claims for the ID token are unmodifiable using token inline hooks and are unusable as custom claims.
