Decoding an Identity Token (ID token) for an OpenID Connect (OIDC) application allows administrators to inspect the token and ensure Okta sends the expected information to the application. Retrieving the ID token via the authorization code flow and decoding it using an Okta token tool reveals the header and payload claims. Administrators need to inspect the ID token to verify the user information and authentication status returned by the OIDC application.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC) Applications

Developers may want to inspect the ID token to ensure the right information is being sent from Okta to the application.

How is an ID token decoded for an OpenID Connect application?

Assign a test user to the application, configure a local redirect Uniform Resource Identifier (URI), complete the authorization code flow to retrieve the token, and decode it using an Okta token tool.

1. Assign a test user to the OIDC application.
2. Go to the General tab of the OIDC application and add https://localhost:8080 to the Sign-in redirect URIs for testing purposes.

The following image demonstrates adding a local redirect URI to the application settings.

3. Locate the Client ID on the General tab and copy the value.
4. Follow the Authorization Code flow documentation to construct the authorize call and complete the flow to retrieve the ID token.
5. Copy the ID token and paste it into an Okta token decoding tool, such as jwt.io or token.dev, to view the user information.

The following image demonstrates a decoded JSON Web Token (JWT) displaying the header and payload claims.

NOTE: To return groups in the token, ensure the Groups claim is added, as shown in the Attribute/Claim Missing from ID Token documentation.

Related References

• Customize tokens returned from Okta with custom claims
• Attribute/Claim Missing from ID Token