Token Formats

OpenID Connect lets you control the cryptographic shape of two outputs: the ID Token and the UserInfo response. ThunderID supports four formats and a curated set of algorithms, picked from the JOSE standards (RFC 7515 JWS, RFC 7516 JWE, RFC 7518 JWA).

The choice trades operational simplicity against confidentiality. JWS gives you integrity. JWE gives you confidentiality. NESTED_JWT gives you both.

Format Matrix

Format	Applies to	Signed	Encrypted	Content-Type
JSON	UserInfo only	❌	❌	application/json
JWS	ID Token (default), UserInfo	✅	❌	application/jwt
JWE	ID Token, UserInfo	❌	✅	application/jwt
NESTED_JWT	ID Token, UserInfo	✅	✅	application/jwt

For the ID Token, JWS is the default and the most widely supported. Pick JWE or NESTED_JWT only when the ID Token will traverse an untrusted intermediary that must not read its contents.

For UserInfo, JSON is the default. Switch to JWS when integrity matters; to JWE or NESTED_JWT when confidentiality matters.

Signing Algorithm (JWS)

Applies to JWS and the signing step of NESTED_JWT.

ThunderID signs every token (access token, ID Token, and signed UserInfo response) with the deployment signing key, and the algorithm follows that key's type, for example an RSA key signs with RS256 and an Ed25519 key signs with EdDSA.

To see which algorithm a deployment signs with, read id_token_signing_alg_values_supported (and userinfo_signing_alg_values_supported) in the Server Metadata document, or inspect the published keys at the JWKS endpoint. Clients verify signatures against those keys.

Supported Encryption Algorithms (JWE)

Applies to JWE and the encryption step of NESTED_JWT.

Key Management (alg)

Algorithm	Description
RSA-OAEP	RSA-OAEP with SHA-1
RSA-OAEP-256	RSA-OAEP with SHA-256 (preferred)

Both alg values are RSA-based, so the client certificate must contain an RSA encryption key (use: enc, or no use) that the selected alg can use.

Content Encryption (enc)

Algorithm	Description
A128CBC-HS256	AES-128-CBC + HMAC-SHA-256 authentication tag
A256GCM	AES-256 in Galois/Counter Mode (preferred when supported)

Token Lifetimes

Access token and ID token lifetimes are configured per application. Both default to 3600 seconds (one hour).

Setting	Default	Description
token.accessToken.validityPeriod	3600	Access token lifetime in seconds
token.idToken.validityPeriod	3600	ID token lifetime in seconds

Refresh tokens are governed separately. See Refresh Token.

Embedded User Attributes

The userAttributes array on each token type controls which user attributes are embedded as claims.

Setting	Description
token.accessToken.userAttributes	Attributes embedded in the access token payload. Standard claims (sub, iss, exp, …) are always included and cannot be removed.
token.idToken.userAttributes	Attributes embedded in the ID token. Only attributes covered by the requested scopes are returned. See Claims & Scopes.

Certificate Prerequisites

Encrypted responses (JWE, NESTED_JWT) and private_key_jwt client authentication require an OAuth client certificate: either an inline JWKS or a JWKS_URI ThunderID can fetch. See OAuth client certificate for the full rules.

Use case	Certificate required?	Reason
JWS ID Token (default)	No	ThunderID signs with its own key (see JWKS)
JWE / NESTED_JWT ID Token	Yes	Encrypted to the client's public key
JWS UserInfo	No	ThunderID signs with its own key
JWE / NESTED_JWT UserInfo	Yes	Encrypted to the client's public key
private_key_jwt client auth	Yes	Verifying the client's signed assertion

Try It in ThunderID

Console

1. Open Applications or Agents in the ThunderID Console and select your client.
2. Open the Token tab.
3. Use the ID Token section to configure ID Token format and, for encrypted formats, encryption. Signing uses the deployment signing key.
4. Use the UserInfo section to configure the UserInfo response format.
5. For encrypted responses, configure a Certificate in the OAuth client settings.
6. Save.

Dynamic Client Registration

Per RFC 7591 field names:

POST /oauth2/dcr/register
Content-Type: application/json

{
  "client_name": "Secure App",
  "redirect_uris": ["https://app.example.com/callback"],
  "grant_types": ["authorization_code"],
  "response_types": ["code"],

  "id_token_encrypted_response_alg": "RSA-OAEP-256",
  "id_token_encrypted_response_enc": "A256GCM",

  "userinfo_encrypted_response_alg": "RSA-OAEP-256",
  "userinfo_encrypted_response_enc": "A256GCM",

  "jwks_uri": "https://app.example.com/.well-known/jwks.json"
}

Inspect What a Deployment Advertises

The supported algorithms are listed in the Server Metadata document, for example, id_token_signing_alg_values_supported and userinfo_encryption_enc_values_supported.

Related Guides

• OpenID Connect, the spec that defines ID Token shape
• UserInfo, the endpoint whose response format is selected here
• JWKS, ThunderID's signing keys
• Client Authentication Methods: OAuth client certificate, attaching the client's public key