### PKCE Implementation

PKCE (Proof Key for Code Exchange) is mandatory. Generate a code verifier and challenge:

// Generate code verifier (43-128 characters) const codeVerifier \= base64URLEncode(crypto.randomBytes(32)); // Generate code challenge const codeChallenge \= base64URLEncode( crypto.createHash('sha256').update(codeVerifier).digest() );

### Scope and Claims

#### Standard OIDC Scopes

*   `openid` - Required for OIDC. Returns `sub` claim

*   `profile` - Returns profile information including:

*   `name`, `given_name`, `family_name`, `middle_name`, `nickname`, `preferred_username`

*   `profile`, `picture`, `website`, `gender`, `birthdate`, `zoneinfo`, `locale`, `updated_at`

*   `email` - Returns `email` and `email_verified` claims

*   `phone` - Returns `phone_number` and `phone_number_verified` claims

#### TrueVault Specific Claims (via claims parameter)

Use the `claims` parameter to request specific TrueVault identity data:

**Identity Claims (examples):**

*   `trueidentity.credential` - Identity verification credential

*   `trueidentity.given_name` - Verified given name

*   `trueidentity.family_name` - Verified family name

*   `trueidentity.birth_date` - Verified birth date

*   `trueidentity.email` - Verified email address

*   `trueidentity.phone` - Verified phone number

*   `trueidentity.email_verified` - Email verification status

*   `trueidentity.phone_verified` - Phone verification status

*   `trueidentity.names_verified` - Name verification status

*   See [Userinfo](/oauth-oidc-reference/endpoints/userinfo-endpoint) for full details.

**Document Claims (examples):**

*   `document.passport.travel_document_number` - Australian passport or travel document number

*   `document.passport_foreign.passport_number` - Foreign passport number

*   `document.driving_license.licence_number` - Driver's license number

*   See [Userinfo](/oauth-oidc-reference/endpoints/userinfo-endpoint) for full details.

**Credential Claims (examples):**

*   `trueidentity.credential` - Identity verification credential

*   `trueidentity.credential_valid` - Identity verification credential valid

*   `vevortw.credential` - VEVO Right to Work credential

*   See [Userinfo](/oauth-oidc-reference/endpoints/userinfo-endpoint) for full details.

#### Example Scope Combinations

**Basic Profile Access:**

scope=openid profile email

**Identity & Document Verification:**

claims={"true": \["trueidentity.credential", "trueidentity.given\_name", "trueidentity.family\_name", "trueidentity.birth\_date", "trueidentity.email", "trueidentity.phone", "trueidentity.email\_verified", "trueidentity.phone\_verified", "trueidentity.names\_verified", "document.passport.travel\_document\_number", "document.passport\_foreign.travel\_document\_number", "document.driving\_license.licence\_number"\]}