How to Return the email_verified Claim
Apr 2, 2025
API Access Management
Okta Classic Engine
Okta Identity Engine
Overview
This article discusses how to return the email_verified claim depending on the authorization flow.
Applies To
- Implicit Flow
- Authorization code flow
- OIDC
- Tokens
Solution
The email_verified claim is dependent on the email scope and is returned in the following scenarios:
- With an implicit flow and
response_typebeingid_token, onlyemail_verifiedwill be returned in the ID token.- A
response_typeofid_token tokenwill not returnemail_verified.
- A
- Sending a request to /userinfo with the access token included in the HTTP authorization header:
NOTE: For Okta Integration Network (OIN) integrations, independent software vendors should not rely on the
email_verified scope-dependent claim returned by an OIDC integration to evaluate whether a user has verified ownership of the email address associated with their profile. 
