OIDC Bearer Tokens: List of Reserved Claims
Mar 27, 2026
API Access Management
Okta Classic Engine
Okta Identity Engine
Overview
Specifying certain claim names on a custom authorization server, adding certain claim names via a token inline hook, or attempting to modify certain claims with a token inline hook will result in an error.
Applies To
- API Access Management
- Custom Claims
- Token Inline Hooks
Cause
Okta defines a number of reserved claims that cannot be overridden.
Solution
When adding a custom claim to a token or modifying a claim, the following reserved claims will not be usable.
| Claim Name | Token Type |
|---|---|
| acr | Access Token |
| amr | Access Token |
| as_uri | Access Token |
| cid | Access Token |
| groups | Access Token |
| rpt | Access Token |
| rsi | Access Token |
| uid | Access Token |
| username | Access Token |
| active | ID Token |
| aid | ID Token |
| aud | ID Token |
| app_id | ID Token |
| app_type | ID Token |
| at_hash | ID Token |
| auth_time | ID Token |
| client_id | ID Token |
| client_ip | ID Token |
| client_req_id | ID Token |
| client_type | ID Token |
| client_user_agent | ID Token |
| cnf | ID Token |
| c_hash | ID Token |
| device_compliance | ID Token |
| device_id | ID Token |
| device_known | ID Token |
| device_managed | ID Token |
| device_name | ID Token |
| device_trust | ID Token |
| did | ID Token |
| dst | ID Token |
| group | ID Token |
| hotk | ID Token |
| idp | ID Token |
| idp_iss | ID Token |
| mac_key | ID Token |
| may_act | ID Token |
| nonce | ID Token |
| oid | ID Token |
| okta_emailVerified | ID Token |
| okta_lastUpdated | ID Token |
| orig | ID Token |
| permissions | ID Token |
| purpose | ID Token |
| pwd_exp_days | ID Token |
| pwd_exp_time | ID Token |
| rid | ID Token |
| role | ID Token |
| scope | ID Token |
| scopes | ID Token |
| sid | ID Token |
| sub | ID Token |
| term | ID Token |
| user_ip | ID Token |
| iss | Access Token & ID Token |
| jti | Access Token & ID Token |
| token_type | Access Token & ID Token |
| ver | Access Token & ID Token |
In addition, there are several Scope-dependent claims for the ID Token that can not be used as well. While not technically reserved and therefore modifiable using Token Inline Hooks, they are unusable as custom claims.
