diff --git a/.changeset/oauth-idtoken-member.md b/.changeset/oauth-idtoken-member.md new file mode 100644 index 00000000000..f13ed6141fc --- /dev/null +++ b/.changeset/oauth-idtoken-member.md @@ -0,0 +1,5 @@ +--- +"@clerk/backend": patch +--- + +Add optional `idToken` member to `OauthAccessToken` returned by `getUserOauthAccessToken`. The ID token is retrieved from OIDC providers and is only present for OIDC-compliant OAuth 2.0 providers when available. diff --git a/packages/backend/src/api/resources/JSON.ts b/packages/backend/src/api/resources/JSON.ts index d2cdd0c7b6a..6128e1ddc16 100644 --- a/packages/backend/src/api/resources/JSON.ts +++ b/packages/backend/src/api/resources/JSON.ts @@ -300,6 +300,8 @@ export interface OauthAccessTokenJSON { // Only set in OAuth 1.0 tokens token_secret?: string; expires_at?: number; + // Only present for OIDC-compliant OAuth 2.0 providers when available + id_token?: string; } export interface OAuthApplicationJSON extends ClerkResourceJSON { diff --git a/packages/backend/src/api/resources/OauthAccessToken.ts b/packages/backend/src/api/resources/OauthAccessToken.ts index ce08f22fcc6..e83c8f4089c 100644 --- a/packages/backend/src/api/resources/OauthAccessToken.ts +++ b/packages/backend/src/api/resources/OauthAccessToken.ts @@ -10,6 +10,11 @@ export class OauthAccessToken { readonly scopes?: string[], readonly tokenSecret?: string, readonly expiresAt?: number, + /** + * The ID token retrieved from the OIDC provider. + * Only present for OIDC-compliant OAuth 2.0 providers when available. + */ + readonly idToken?: string, ) {} static fromJSON(data: OauthAccessTokenJSON) { @@ -22,6 +27,7 @@ export class OauthAccessToken { data.scopes, data.token_secret, data.expires_at, + data.id_token, ); } }