Quiz Entry - updated: 2026.10.22
Which parameters does an OpenID Connect authentication request carry, and what does each one do?
Required: response_type, scope (including openid), client_id, redirect_uri, plus state (treat it as required); optional: nonce and max_age, among others.
| Parameter | Meaning | Example |
|---|---|---|
response_type |
Which flow is wanted; code = authorization code flow (access and ID token come from the token endpoint). |
code |
scope |
Which user data is requested; must contain openid to activate OIDC. |
openid profile email (URL-encoded: openid%20profile%20email) |
client_id |
Identifier of the client (RP), from registration. | s6BhdRkqt3 |
redirect_uri |
Where to send the result of the authentication; must match a registered URI. | https://client.example.org/cb |
state |
Opaque value to match the callback to the request (CSRF protection). | af0ifjsldkj |
nonce |
Value that associates the client session with the ID token; prevents or hinders replay. | n-0S6_WzA2Mj |
max_age |
Maximum age of the user's authentication in seconds; if exceeded, the OP must make the user log in again. | 3600 |
The specification formally lists state as recommended, but since it is the standard CSRF defence for the callback, it should always be sent. nonce is optional in the code flow but required in the implicit flow, where it is the only protection against a replayed ID token.
Go deeper:
OpenID Connect Core 1.0: Authentication Request — every parameter with its requirement level, including prompt,login_hintandacr_values.