Request identity information
An application needs an ID token identifying the signed-in user.
Kinde · Const
Scopes
Kinde OAuth scopes specify the protected user information or offline capability an application requests. Standard values include openid, email, profile, and offline.
How it works
Scopes are OAuth permissions requested by an application and granted in a token. Kinde documents standard scopes for identity and user information, while the exact request format depends on the OAuth flow and application framework.
Syntax
scope=openid profile email offlineParameters
| Name | Type | Description |
|---|---|---|
scope | string | Space-separated OAuth scope values requested by the application, such as openid, profile, email, or offline. |
Returns
Depending on the requested scopes and flow, Kinde returns tokens containing the authorized identity, email, profile, or offline-access capabilities.
Key points
- Scopes declare which categories of user-protected information an application wants to access.
- The
openidscope asks Kinde to return an ID token with user information. - The
emailscope requests the user’s email data. - The
profilescope adds profile information, such as a name or avatar, to the ID token. - The
offlinescope supports continued operation when the user is not actively present.
Common mistakes
- Kinde uses the scope name
offline; do not substitute the OIDC nameoffline_accesswhen requesting a refresh token. - The authorization request must follow the requirements of the framework and OAuth flow being used.
Example: Request OAuth scopes
const requestedScopes = ["openid", "profile", "email", "offline"];
const authorizationUrl = new URL("https://<your-kinde-domain>/oauth2/auth");
authorizationUrl.searchParams.set("scope", requestedScopes.join(" "));
console.log(authorizationUrl.toString());Builds an authorization URL requesting Kinde’s documented OAuth scopes.
When to use it
Request user details
A frontend or backend needs the user’s email and basic profile fields.
Request offline access
A service must refresh access after the user is no longer active.
Interview questions
QWhat are OAuth scopes in Kinde?
Scopes represent permissions requested for protected information. Kinde documents openid, email, profile, and offline as standard OAuth scopes.
Follow-up: What does offline provide? It requests a refresh token that can renew an access token after it expires.
QWhat do the standard Kinde scopes do?
openid requests an ID token containing user information, while email requests email-related claims and profile requests profile details in the ID token.
Follow-up: Which scope is needed for a refresh token? Use offline, not offline_access.
QHow are scopes requested?
The syntax for requesting scopes depends on the OAuth flow and application framework. For an authorization request, the requested scope values are supplied as part of that flow’s parameters.
Follow-up: What should a developer check before implementing the request? Verify the flow-specific requirements, such as PKCE parameters when using the PKCE authorization-code flow.
Related
openidemailprofileofflineAuthorization Code flowAuthorization Code flow with Proof Key for Code Exchange (PKCE)