claimnames

Claim names are identifiers used in claims-based identity systems to label assertions about a subject, such as a person or device. They appear as keys in data structures such as JSON Web Tokens (JWT), OpenID Connect ID tokens and UserInfo responses, and SAML attribute statements. A claim name maps to a particular attribute, such as name, email, sub (subject), or roles, and can be standard or custom. In many ecosystems, standardized claim names are defined by specifications; custom claims are defined by the issuer and may be namespaced to avoid collisions.

In OpenID Connect and JWT, registered claim names are defined by the specification; examples include sub, name, preferred_username, email, and exp. SAML uses attribute names to convey similar information, with a variety of formats and namespaces. Claim names are used by relying parties to obtain verified user attributes for authentication, authorization, personalization, and auditing. They are typically provided by identity providers and may be delivered in ID tokens, access tokens, or through user information endpoints.

Security and privacy considerations include validating the issuer and audience, verifying signatures, and limiting the amount of sensitive data exposed. Interoperability challenges include varying naming conventions across providers, necessitating attribute mapping and namespace management. Example: after a user authenticates via OpenID Connect, an ID token may include claims such as sub, name, and email; an application may also query the userinfo endpoint for additional claims. See also OpenID Connect, JWT, SAML, and claims-based identity.