Scopes and claims
What each scope grants and which claims come back.
Supported scopes
| Scope | Grants | UserInfo claims |
|---|---|---|
openid |
Identity (required for OIDC) | sub |
profile |
Display name, profile picture and wallet address | name, given_name, family_name, picture, wallet |
email |
Email address | email, email_verified |
offline_access |
Refresh token | - |
mcp:read |
Read access to the MCP resource | - |
The profile scope shares the user's wallet address. Treat it as personal data.
Only ask for what you need: every scope is shown to the user on the consent screen, and users can revoke access at any time from Account settings, Developers tab, Authorized applications.
Claims in the ID token
The ID token always contains iss, sub, aud, exp, iat, sid and the nonce you sent. Profile and
email claims are served through the userinfo endpoint instead of being duplicated in the ID token, so treat
the access token as the source of truth for API calls.
Claims in the access token
| Claim | Meaning |
|---|---|
sub |
Amped.Bio user id |
client_id / azp |
Your client_id |
scope |
Granted scopes |
sid |
Session id (tokens stop verifying once the session ends) |
aud |
Requested resource, or the userinfo endpoint |
wallet |
The user's wallet address, with profile or mcp:read. null when no wallet is linked |
Requesting specific claims
OpenID Connect lets a client ask for individual claims:
claims={"userinfo":{"email":null,"email_verified":null}}wallet is returned for a claims request under any scope, and is null when the user has not linked a
wallet. The consent screen names the wallet address in the profile line, so users see that it is shared.