Tokens
ThunderID issues OAuth 2.0 tokens that authenticate users and authorize access to protected resources. Each token type serves a different purpose.
Access Tokens
Access tokens are JWTs that a client presents to a resource server to access protected resources. Key claims include:
| Claim | Description |
|---|---|
sub | The subject, the user ID or client ID the token represents. |
aud | The audience: one resource server identifier, or the application's default audience (token.accessToken.defaultAudience, falling back to client_id) for an unbound OIDC-only or scopeless token. |
scope | The granted scopes, the permissions the token carries. |
iss | The issuer, the ThunderID instance that issued the token. |
exp | The expiry time as a Unix timestamp. |
Audience Claim Behavior
The aud claim varies based on whether the client used resource indicators:
- With
resourceparameter: Theaudclaim contains the identifier of the targeted resource server. - Without
resource, with permission scopes: ThunderID uses the configureddefaultResourceServer. If no default is configured, token issuance fails withinvalid_target. - Without
resourceand permission scopes: Theaudclaim contains the application's default audience (token.accessToken.defaultAudience), or the requesting client'sclient_idwhen it is unset. - Serialization: The single audience is serialized as a JSON string (for example,
"aud": "https://api.example.com/booking"), per RFC 7519 Section 4.1.3.
Resource servers that validate tokens should require aud to match their own resource server identifier.
Refresh Tokens
Refresh tokens allow a client to get a new access token without requiring the user to re-authenticate. A refresh token is issued alongside the access token when the client uses a grant type that supports refresh (such as the authorization code grant).
When refreshing, the client can include the resource parameter only for the resource server already bound to the refresh token. See Resource Indicators: Resource on Refresh.
ID Tokens
ID tokens are JWTs issued alongside access tokens in OpenID Connect flows. The aud claim of an ID token always contains the requesting application's client ID, regardless of resource indicators. ID tokens identify the authenticated user to the client application and are not intended for resource server authorization.
