> For the complete documentation index, see [llms.txt](https://docs.corppass.gov.sg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-legacy/endpoints/token-endpoint/id-token-structure.md).

# ID Token Structure

The ID Token contains both standard claims and Corppass-specific custom claims.

<table><thead><tr><th width="184">Claim</th><th width="379">Claim Content</th><th>Claim Format</th></tr></thead><tbody><tr><td>Standard Claims</td><td>Standard claims such as <code>iss</code> <em>,</em> <code>iat</code><em>, <code>exp,</code></em> etc., as defined in the <a href="https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims">Section 5.1. of OIDC Core Specification</a></td><td>String</td></tr><tr><td>Custom Claims</td><td><p>Corppass-specific claims providing details about the authenticated user:</p><ul><li><code>userInfo</code>: Includes Corppass user's personal information, such as full name and account type</li><li><code>entityInfo</code>: Includes Corppass user's entity information, detailing entities the user is authorized for or selected during authorization (applicable when the user has access to multiple entities)</li></ul></td><td>JavaScript Notation Object (JSON)</td></tr></tbody></table>

#### ID Token Format

The ID Token is issued as a JWS encapsulated in a JWE (compact serialisation). Below is an overview of its structure:

<table><thead><tr><th width="239">Component</th><th>Description</th></tr></thead><tbody><tr><td>JWE Header</td><td>Contains metadata such as the encryption algorithm (<code>alg</code>) and key identifier (<code>kid</code>).</td></tr><tr><td>Encrypted Payload</td><td>Contains the Base64-encoded representation of the JWS (decrypted).</td></tr><tr><td>JWS Header</td><td>Includes metadata such as the signing algorithm (<code>alg</code>) and the key identifier (<code>kid</code>).</td></tr><tr><td>JWS Payload</td><td>Contains claims, including user and authorization information.</td></tr><tr><td>Signature</td><td>Ensures the integrity and authenticity of the payload.</td></tr></tbody></table>

{% hint style="warning" %}
Clients **must** use the kid field in the JWE header to identify the key Corppass used for encryption. Refer to [RFC 7515 Section 4](https://tools.ietf.org/html/rfc7515#section-4) for more information about the JWE structure.
{% endhint %}

#### **JWS Payload Example**

The following an example of the JWS payload returned by the ID Token

<table data-header-hidden><thead><tr><th></th></tr></thead><tbody><tr><td><pre class="language-json"><code class="lang-json">{
    "iat": 1623162109,
    "iss": "https://stg-id.corppass.gov.sg",
    "at_hash": "6J4VlBBQpbAyy1NL4NBW-Q",
    "sub": "s=S1234567P,uuid=0f14a2fc-09c2-4780-95f0-8c28347f2780,u=CP192,c=SG",
    "exp": 1623165709,
    "aud": "vOIljWVrGyBMK6f31QYq",
    "amr": ["pwd", "sms"],
    "nonce": "ZEF+97zc3YZP7huv6nzKspfabDv0wRtce/aVNud23vU=",
    "userInfo":{
        "CPAccType": "User",
        "CPUID_FullName": "John Grisham",
        "ISSPHOLDER": "YES"
    },
    "entityInfo": {
        "CPEntID": "82532759L",
        "CPEnt_TYPE": "UEN",
        "CPEnt_Status": "Registered",
        "CPNonUEN_Country": "",
        "CPNonUEN_RegNo": "",
        "CPNonUEN_Name": ""
    }
}
</code></pre></td></tr></tbody></table>

#### **Claims in the JWS Payload**

<table><thead><tr><th width="167">Claim</th><th width="111">Type</th><th>Description</th></tr></thead><tbody><tr><td>aud</td><td>String</td><td>The client ID of the Relying Party. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.3">Section 4.1.3 of RFC 7519</a>.</td></tr><tr><td>iss</td><td>String</td><td>The issuer of the token. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.1">Section 4.1.1 of RFC 7519</a>.</td></tr><tr><td>iat</td><td>Number</td><td>The time the token was issued, expressed as a UNIX timestamp. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.6">Section 4.1.6 of RFC 7519</a>.</td></tr><tr><td>exp</td><td>Number</td><td>The expiration time of the token, expressed as a UNIX timestamp. The default validity is 10 minutes from <code>iat</code>. Refer to <a href="https://tools.ietf.org/html/rfc7519#section-4.1.4">Section 4.1.6 of RFC 7519</a>.</td></tr><tr><td>nonce</td><td>String</td><td>A unique string to associate the ID Token with the authorization request to prevent replay attacks.</td></tr><tr><td>amr</td><td>Array</td><td>Authentication methods used during Singpass login</td></tr><tr><td>at_hash</td><td>String</td><td>A hash of the Access Token issued alongside the ID Token.</td></tr><tr><td>sub</td><td>String</td><td><p>The principal that is the subject of the JWT. It contains a comma-separated list of <code>key=value</code> pairs that uniquely identify the user, which may include multiple alternate identifiers.</p><p></p><p><strong>Format</strong></p><p>The format of the <code>sub</code>  is as follows:</p><ul><li><code>s</code> : Identity ID (e.g. NRIC/FIN/Foreign ID)</li><li><code>uuid</code> : User's globally unique identifier (e.g. <code>0f14a2fc-09c2-4780-95f0-8c28347f2780</code> )</li><li><code>u</code> : System-defined ID (e.g. <code>CP1234</code> )</li><li><code>c</code> : Two-character country code, conforming to ISO 3166-1 Alpha-2 (e.g. <code>SG</code> )</li></ul><p></p><p><strong>Example:</strong></p></td></tr><tr><td>userInfo</td><td>JSON</td><td><p>Contains the user's personal information, such as full name and account type.</p><p></p><p>Refer to the <a href="/pages/OPM4UyI1yUEiovbeqDYy">UserInfo Claim Structure</a> section for more details.</p></td></tr><tr><td>entityInfo</td><td>JSON</td><td><p>Includes the user's entity information (e.g., entity type, ID) used during authentication.</p><p></p><p>Refer to the <a href="/pages/HnIT7vkNaWH3jYNW4M5J">EntityInfo Claim Structure</a> section for more details.</p></td></tr></tbody></table>