OIDC Standard Claim Lookup

OpenID Connect standardises a set of claims — the fields describing the user inside an identity token. Standardising matters because it lets you swap providers without rewriting the application: the field identifying a person is called the same thing at Google, at Keycloak and at Auth0. Outside that set, every provider invents whatever it likes.

Pick the claim and the page explains what it carries. The most important is the subject identifier: it is the only one guaranteed unique and stable per user within that issuer, and it is what the application should tie its local record to. The rest are informational and can change — the email included.

Two recurring traps. The first is using the email as an identifier: it changes, it can be reassigned to another person on a corporate domain, and the field saying whether it was verified is usually ignored. The second is assuming every claim always arrives: most depend on the requested scope and on what the provider decides to return, so the application has to tolerate absence.