Scopes & claims

What each scope grants, and which claims arrive where.

Supported scopes

Scope	Grants
`openid`	Marks the request as OpenID Connect and issues an `id_token`. Without it you get an access token but no ID token.
`profile`	`name`, `preferred_username`, `picture`
`email`	`email`, `email_verified`

Request them space-separated: scope=openid profile email.

Claims, and where they appear

Claims are split between the ID token and the userinfo response. They are not identical — picture is only on userinfo.

Claim	Scope	id_token	userinfo
`sub`	`openid`	yes	yes
`name`	`profile`	yes	yes
`preferred_username`	`profile`	yes	yes
`picture`	`profile`	no	yes
`email`	`email`	yes	yes
`email_verified`	`email`	yes	yes
`nonce`	—	yes, when sent	no

If you need the profile picture, call /oauth/userinfo — decoding the ID token alone will not give it to you.

Example userinfo response

{
  "sub": "6a440e1af32b71278bc2a9f7",
  "name": "Jane Doe",
  "preferred_username": "jane.doe",
  "picture": "https://account.gocosys.com/uploads/avatars/…png",
  "email": "jane.doe@example.com",
  "email_verified": true
}

What is never shared

Users can store a phone number, date of birth, gender, bio and postal address on their GOCOSYS account. None of these are exposed through any scope — no current scope maps to them, in either the ID token or userinfo. If your application needs them, collect them yourself.

Identifying users correctly

Key on sub. It is stable for the lifetime of the account.
Do not key on email or username. Both can change, and you would treat the same person as somebody new.
Check email_verified before trusting an address for anything security-relevant, such as matching an existing local account.
sub is unique per GOCOSYS account, and the same value is given to every client — it is not a per-client pseudonym.

Asking for less

Request only the scopes you use. A shorter permission list on the consent screen is approved more readily, and adding a scope later re-prompts existing users, since they are being asked for something they have not yet approved.