Decode an ID Token for an OIDC Application
Apr 9, 2026
API Access Management
Okta Classic Engine
Overview
This article describes the process to decode an Identity Token (ID Token) for an OpenID Connect (OIDC) application.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC) Applications
Cause
Developers may want to inspect the ID token to ensure the expected information is being sent from Okta to the application.
Solution
The ID token, returned by an OIDC application, contains information about a user and their authentication status. The following steps will describe how to decode the ID token, available in JSON Web Token (JWT) format, to get the required information about the user:
- Assign a test user to the OIDC application.
- Go to the General tab of the OIDC Application and add https://localhost:8080 for the Login redirect URIs for testing purposes. Add any other URL as well, if needed.
- Again, from the General tab of the OIDC Application, locate the Client ID, copy it, and save it somewhere.
- Follow the authorization code flow documentation at the Authorization Code flow documentation to construct the authorize call and complete the flow.
- Copy the ID token to Okta's jwt.io or token.dev. It will return information about this test user:
NOTE: To return groups in the token, make sure the Groups Claim is added, as shown in Attribute/Claim Missing from ID Token.
