Skip to main content

openid.connect.token method

Usage info​

This special method is part of implementing Sign in with Slack.

As part of Sign in with Slack, this method allows your app to receive information about a user who signs into your service with their Slack profile.

A potential gotcha: while redirect_uri is optional, it is required if your app passed it as a parameter to /openid/connect/authorize in the first step of the Sign in with Slack flow.

Response​

The id_token in the response is a standard JSON Web Token (JWT). . When it's decoded, you'll see a payload like:

  "iss": "https://slack.com",
  "sub": "U0R7MFMJM",
  "aud": "25259531569.11152291",
  "exp": 1626874955,
  "iat": 1626874655,
  "auth_time": 1626874655,
  "nonce": "abcd",
  "at_hash": "tUbyWGBHe0V32FJEupkgVQ",
  "https://slack.com/team_id": "T0RR",
  "https://slack.com/user_id": "U0JM",
  "email": "bront@slack-corp.com",
  "email_verified": true,
  "date_email_verified": 1622128723,
  "locale": "en-US",
  "name": "brent",
  "given_name": "",
  "family_name": "",
  "https://slack.com/user_image_24": "https://secure.gravatar.com/avatar/bc.png",
  "https://slack.com/user_image_32": "...",
  "https://slack.com/user_image_48": "...",
  "https://slack.com/user_image_72": "...",
  "https://slack.com/user_image_192": "...",
  "https://slack.com/user_image_512": "...",
  "https://slack.com/team_image_34": "...",
  "https://slack.com/team_image_44": "...",
  "https://slack.com/team_image_68": "...",
  "https://slack.com/team_image_88": "...",
  "https://slack.com/team_image_102": "...",
  "https://slack.com/team_image_132": "...",
  "https://slack.com/team_image_230": "...",
  "https://slack.com/team_image_default": true

iss, sub, aud, exp, iat, auth_time, nonce, and at_hash are each defined by the OpenID standard, but here's an overview:

  • iss signifies the issuer of the token.
  • sub signifies the subject of the token.
  • aud signifies the intended audience of the token, the client ID of the OpenID Relying Party.
  • exp signifies the expiration time of the request, meaning that it shouldn't be trusted if it's not received by the expiration time.
  • iat signifies the time when the token was issued.
  • auth_time signifies the time when the end-user authenticated.
  • nonce is a state variable that you pass to the /openid/connect/authorize endpoint at the beginning of Sign in with Slack, and that Slack then returns to you at the end of the flow here. Verify that it matches the nonce you passed to /authorize.