Skip to main content
View as Markdown

Access token claims

Altium 365 access tokens are signed JWTs (header typ: at+jwt, alg: RS256). You can base64url-decode the payload to see who the token is for, which application obtained it, what it grants, and which cloud it belongs to.

Validate before you trust. Verify the token's signature against the issuer's JWKS (published in the discovery document) and check exp/iss/aud before relying on any claim. Decoding alone does not prove authenticity.

Example payload (a GovCloud workspace token; identifiers shown as placeholders):

{
  "iss": "https://auth.365-gov.altium.com",
  "sub": "00000000-0000-0000-0000-000000000000",
  "client_id": "11111111-1111-1111-1111-111111111111",
  "scope": ["a365:workspace:22222222-2222-2222-2222-222222222222", "openid", "profile", "offline_access"],
  "workspaceId": "22222222-2222-2222-2222-222222222222",
  "secure": "1",
  "iat": 1783517196,
  "exp": 1783531596
}

The claims that matter​

ClaimPresent onMeaning
issevery tokenIssuer — the base URL that minted the token, which identifies the cloud: https://auth.altium.com (Commercial), https://auth.365-gov.altium.com (GovCloud), or {origin}/unifiedlogin (AES, on-prem).
subevery tokenSubject — for user tokens, the user's ID (a stable identifier; the same value the userinfo endpoint returns as sub).
client_idevery tokenThe application — the registered OAuth client that obtained the token.
scopeevery tokenThe granted scopes. A workspace token includes a365:workspace:{workspaceId}; offline_access means a refresh token was issued alongside it.
workspaceIdworkspace tokensThe workspace's authId — the single workspace this token grants access to (it matches the a365:workspace: scope). Absent on global tokens, and on all AES tokens.
secureGovCloud tokens"1" — marks a GovCloud token bound to GovCloud. Absent on Commercial and AES tokens.

Reading the token kind from the claims​

  • Global vs. workspace token — a workspace token has a workspaceId claim and an a365:workspace:{id} scope; a global token has neither.
  • Commercial vs. GovCloud token — a GovCloud token carries secure: "1" and a Gov iss; a Commercial token has no secure claim. See GovCloud considerations.
  • AES (on-prem) token — a workspace token has a a365:workspace:{id} scope, but there is no workspaceId claim and no secure claim (same as Commercial). iss is the AES installation's own {origin}/unifiedlogin base. See AES (on-prem) considerations.

Standard claims​

Tokens also carry the usual OAuth 2.0 / OIDC JWT claims — iat, nbf, exp (validity window, epoch seconds), aud (audience), jti (token ID), amr (authentication methods), sid (session ID), and idp (identity provider). Treat any claim not listed above as an implementation detail that may change.


Comments​