Verified claims
What Avonao ID vouches for when a member signs in to your app, what it leaves out on purpose, and what is still to come.
What you can rely on today
| Signal | Where | What it tells you |
|---|---|---|
email and email_verified: true | ID token, /userinfo (scope email) | The member controls this address: they proved it with a sign-in link or code, or a social provider verified it. Avonao ID never sends an unverified address, so email_verified is always true. The member can change their primary email later; the sub does not change. |
sub | ID token, /userinfo | One Avonao ID has exactly one id for your business. It does not prove that two different Avonao IDs belong to two different people. More |
amr and auth_time | ID token | How and when the member signed in. amr lists the methods (email, a social provider, webauthn and uv for a passkey that verified the person, totp or recovery_code with mfa after a second factor). Use it when an action in your app needs a recent or stronger sign-in; ask for prompt=login to make the member sign in again. |
name and locale | ID token, /userinfo (scope profile) | What the member chose to call themselves, and their language. Not a verified legal name, and the name can be null. |
Consent signals
- For an app of a business, the member always sees a consent screen on the first sign-in, with your app, your business name and your verified domain, and the data you asked for. You receive a
codeonly after they chose Allow. If they chose "Don't allow", you geterror=access_deniedwithout a description. - Later sign-ins skip the screen while the member's consent still covers the scopes you ask for. Ask for more scopes and the screen comes back;
prompt=consentshows it on purpose. - Members see your app under "Your apps" with a record of what they allowed, and can revoke it at any time. The next sign-in then asks again. You hear about a revoke through the
grant.revokedwebhook.
Age
Verified identity
What is never sent
No phone number, birthdate, postal address, picture, country, group or role claims, and no list of the member's other apps. Scopes beyond openid, email and profile are refused with invalid_scope.
Avonao ID
