Scopes and claims
The scopes an authentication can request, the claims each scope returns in the ID token, and the wallets that supply them.
Every authentication request includes openid and at least one scope from the tables below. The Studio flow defines which scopes each wallet may release, and your client requests a subset of them. The ID token contains only claims that are both offered by the flow and requested by the client.
Studio shows the wallets and scopes available to your organization. Wallet availability and status are published on ver.id/resources/wallets.
Claim shapes
Claims arrive in three shapes. Identity providers such as Keycloak map a nested field with dot notation, for example nin.identifier.
| Shape | Description | Example |
|---|---|---|
| String | A flat claim | "given_name": "Anna" |
| Boolean | A verification flag next to a contact claim | "email_verified": true |
| Object | A nested object with its own fields | "nin": { "identifier": "…", "identifier_type": "NL_BSN" } |
Standard scopes
These scopes follow OpenID Connect Core 1.0 section 5.1; address follows section 5.1.1.
| Scope | Claims in the ID token | Shape | Wallets |
|---|---|---|---|
profile | given_name, family_name, middle_name, name, and updated_at when the wallet supplies it | string | Yivi (from the BRP), Datakeeper, Digidentity, Yoti |
email | email, email_verified | string, boolean | Yivi, Datakeeper, Digidentity, Yoti |
phone | phone_number, phone_number_verified | string, boolean | Yivi, Datakeeper, Digidentity, Yoti |
address | address.formatted, address.street_address, address.street, address.house_number, address.postal_code, address.locality, address.region, address.country | object | Yivi, Datakeeper, Digidentity, Yoti |
birthdate | birthdate | string | Yivi |
Ver.iD scopes
| Scope | Claims in the ID token | Shape | Wallets |
|---|---|---|---|
nin | nin.identifier, nin.identifier_type (NL_BSN), from the Dutch national identification number (BSN) credential | object | Yivi |
company | company.identifier, company.identifier_type (NL_KVK), company.name, company.type (legal form code such as NL_RR_BV), from the Chamber of Commerce (KVK) credential | object | Yivi |
birth-country | birth_country | string | Yivi |
test-profile | The profile claims, sourced from the BRP test scheme instead of the production scheme | string | Yivi |
testNin | testNin.identifier, testNin.identifier_type; a demo identifier for acceptance tests, not a production BSN | object | Yivi (IRMA Demo) |
Yoti is being deprecated. Studio shows whether it is still available to your organization.
To request a scope from Keycloak, see Add another scope.