ensure that the at_hash value in the ID Token matches the computed Access Token hash value.

Condition: when validating an Access Token issued from the Authorization Endpoint with an ID Token

The value of at_hash in the ID Token MUST match the value produced in the previous step.

validate an Access Token issued from the Authorization Endpoint with an ID Token by hashing the ASCII access_token value, taking the left-most half of the hash, base64url-encoding it, and comparing it to at_hash.

Condition: when validating an Access Token issued from the Authorization Endpoint with an ID Token

To validate an Access Token issued from the Authorization Endpoint with an ID Token, the Client SHOULD do the following: Hash the octets of the ASCII representation of the access_token with the hash algorithm specified in JWA for the alg Header Parameter of the ID Token's JOSE Header.

use the at_hash claim to validate the Access Token in the same manner as for the Implicit Flow, using the ID Token and Access Token returned from the Token Endpoint.

Condition: when using the Authorization Code Flow and the ID Token contains an at_hash Claim

When using the Authorization Code Flow, if the ID Token contains an at_hash Claim, the Client MAY use it to validate the Access Token in the same manner as for the Implicit Flow, as defined in ImplicitTokenValidation, but using the ID Token and Access Token returned from the Token Endpoint.

include the at_hash claim in the ID Token.

Condition: when using the Implicit Flow and the ID Token is issued from the Authorization Endpoint with an access_token value, which is the case for response_type value id_token token

If the ID Token is issued from the Authorization Endpoint with an access_token value, which is the case for the response_type value id_token token, this is REQUIRED;

include the at_hash claim in the ID Token.

Condition: when using the Hybrid Flow and the ID Token is issued from the Authorization Endpoint with an access_token value, which is the case for response_type value code id_token token

If the ID Token is issued from the Authorization Endpoint with an access_token value, which is the case for the response_type value code id_token token, this is REQUIRED; otherwise, its inclusion is OPTIONAL.

include the at_hash claim as an Access Token hash value in an ID Token returned from the Token Endpoint.

Condition: when using the Authorization Code Flow

When using the Authorization Code Flow, these additional requirements for the following ID Token Claims apply: OPTIONAL. Access Token hash value.

include the at_hash claim in the ID Token.

Condition: when using the Hybrid Flow and the ID Token is not issued from the Authorization Endpoint with an access_token value

If the ID Token is issued from the Authorization Endpoint with an access_token value, which is the case for the response_type value code id_token token, this is REQUIRED; otherwise, its inclusion is OPTIONAL.