Get an ID Token

Get an ID Token

To get an ID Token, you need to request one when authenticating a user. Auth0 makes it easy for your app to authenticate users using:

Control ID Token Contents

You control which claims about the authenticated user are included in the ID Token consumed by your application by including specific OpenID Connect Scopes in the scope parameter when you request tokens while authenticating users.

You can also create custom claims, which are claims that you define, control, and add to a token using a rule.

As with any other JWTs, you should follow token best practices when using ID Tokens and validate an ID Token before assuming that its contents can be trusted.

Renew an ID Token

By default, an ID Token is valid for 36000 seconds (10 hours). If there are security concerns, you can shorten the time period before the token expires, but remember that one of the purposes of this token is to improve performance by caching user information.

After an ID Token has expired, you may want to renew your ID Token. To renew the ID Token, you can either reauthenticate the user using Auth0, or use a Refresh Token.

Read more