# ID Token Structure

The ID Token contains both standard claims and Corppass-specific custom claims.

<table><thead><tr><th width="184">Claim</th><th width="379">Claim Content</th><th>Claim Format</th></tr></thead><tbody><tr><td>Standard Claims</td><td>Standard claims such as <code>iss</code> <em>,</em> <code>iat</code><em>, <code>exp,</code></em> etc., as defined in the <a href="https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims">Section 5.1. of OIDC Core Specification</a></td><td>String</td></tr><tr><td>Custom Claims</td><td><p>Corppass-specific claims providing details about the authenticated user:</p><ul><li><code>userInfo</code>: Includes Corppass user's personal information, such as full name and account type</li><li><code>entityInfo</code>: Includes Corppass user's entity information, detailing entities the user is authorized for or selected during authorization (applicable when the user has access to multiple entities)</li></ul></td><td>JavaScript Notation Object (JSON)</td></tr></tbody></table>

#### ID Token Format

The ID Token is issued as a JWS encapsulated in a JWE (compact serialisation). Below is an overview of its structure:

<table><thead><tr><th width="239">Component</th><th>Description</th></tr></thead><tbody><tr><td>JWE Header</td><td>Contains metadata such as the encryption algorithm (<code>alg</code>) and key identifier (<code>kid</code>).</td></tr><tr><td>Encrypted Payload</td><td>Contains the Base64-encoded representation of the JWS (decrypted).</td></tr><tr><td>JWS Header</td><td>Includes metadata such as the signing algorithm (<code>alg</code>) and the key identifier (<code>kid</code>).</td></tr><tr><td>JWS Payload</td><td>Contains claims, including user and authorization information.</td></tr><tr><td>Signature</td><td>Ensures the integrity and authenticity of the payload.</td></tr></tbody></table>

{% hint style="warning" %}
Clients **must** use the kid field in the JWE header to identify the key Corppass used for encryption. Refer to [RFC 7515 Section 4](https://tools.ietf.org/html/rfc7515#section-4) for more information about the JWE structure.
{% endhint %}

#### **JWS Payload Example**

The following an example of the JWS payload returned by the ID Token

<table data-header-hidden><thead><tr><th></th></tr></thead><tbody><tr><td><pre class="language-json"><code class="lang-json">{
    "iat": 1623162109,
    "iss": "https://stg-id.corppass.gov.sg",
    "at_hash": "6J4VlBBQpbAyy1NL4NBW-Q",
    "sub": "s=S1234567P,uuid=0f14a2fc-09c2-4780-95f0-8c28347f2780,u=CP192,c=SG",
    "exp": 1623165709,
    "aud": "vOIljWVrGyBMK6f31QYq",
    "amr": ["pwd", "sms"],
    "nonce": "ZEF+97zc3YZP7huv6nzKspfabDv0wRtce/aVNud23vU=",
    "userInfo":{
        "CPAccType": "User",
        "CPUID_FullName": "John Grisham",
        "ISSPHOLDER": "YES"
    },
    "entityInfo": {
        "CPEntID": "82532759L",
        "CPEnt_TYPE": "UEN",
        "CPEnt_Status": "Registered",
        "CPNonUEN_Country": "",
        "CPNonUEN_RegNo": "",
        "CPNonUEN_Name": ""
    }
}
</code></pre></td></tr></tbody></table>

#### **Claims in the JWS Payload**

<table><thead><tr><th width="167">Claim</th><th width="111">Type</th><th>Description</th></tr></thead><tbody><tr><td>aud</td><td>String</td><td>The client ID of the Relying Party. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.3">Section 4.1.3 of RFC 7519</a>.</td></tr><tr><td>iss</td><td>String</td><td>The issuer of the token. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.1">Section 4.1.1 of RFC 7519</a>.</td></tr><tr><td>iat</td><td>Number</td><td>The time the token was issued, expressed as a UNIX timestamp. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.6">Section 4.1.6 of RFC 7519</a>.</td></tr><tr><td>exp</td><td>Number</td><td>The expiration time of the token, expressed as a UNIX timestamp. The default validity is 10 minutes from <code>iat</code>. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.4">Section 4.1.6 of RFC 7519</a>.</td></tr><tr><td>nonce</td><td>String</td><td>A unique string to associate the ID Token with the authorization request to prevent replay attacks.</td></tr><tr><td>amr</td><td>Array</td><td>Authentication methods used during Singpass login</td></tr><tr><td>at_hash</td><td>String</td><td>A hash of the Access Token issued alongside the ID Token.</td></tr><tr><td>sub</td><td>String</td><td><p>The principal that is the subject of the JWT. It contains a comma-separated list of <code>key=value</code> pairs that uniquely identify the user, which may include multiple alternate identifiers.</p><p></p><p><strong>Format</strong></p><p>The format of the <code>sub</code>  is as follows:</p><ul><li><code>s</code> : Identity ID (e.g. NRIC/FIN/Foreign ID)</li><li><code>uuid</code> : User's globally unique identifier (e.g. <code>0f14a2fc-09c2-4780-95f0-8c28347f2780</code> )</li><li><code>u</code> : System-defined ID (e.g. <code>CP1234</code> )</li><li><code>c</code> : Two-character country code, conforming to ISO 3166-1 Alpha-2 (e.g. <code>SG</code> )</li></ul><p></p><p><strong>Example:</strong></p></td></tr><tr><td>userInfo</td><td>JSON</td><td><p>Contains the user's personal information, such as full name and account type.</p><p></p><p>Refer to the <a href="id-token-structure/userinfo-claim-structure">UserInfo Claim Structure</a> section for more details.</p></td></tr><tr><td>entityInfo</td><td>JSON</td><td><p>Includes the user's entity information (e.g., entity type, ID) used during authentication.</p><p></p><p>Refer to the <a href="id-token-structure/entityinfo-claim-structure">EntityInfo Claim Structure</a> section for more details.</p></td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-legacy/endpoints/token-endpoint/id-token-structure.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.