Scopes and claims
The identity scopes a Sign in with OSINTverse app can request and the claims it receives.
Sign in with OSINTverse apps can request identity scopes only. Asking for anything else fails with invalid_scope.
| Scope | Claims | Shown to people as |
|---|---|---|
openid | sub | Confirm that you have an OSINTverse account |
profile | name, given_name, family_name, picture | See your name and profile picture |
email | email, email_verified | See your email address |
offline_access | A refresh token | Stay signed in without asking again |
Claims come in the ID token and from the userinfo_endpoint.
Tokens
- ID token. A JWT signed with
EdDSA. Verify it against the JWKS in discovery. - Access token. Use it with the
userinfo_endpoint. It does not work on the OSINTverse API or the MCP server: those take anov_API key or an agent connection. - Refresh token. Only with
offline_access. Access tokens last an hour and refresh tokens rotate on use.
What your app never gets
Searches, cases, graphs, wallet balance, billing, team membership, API keys, or the ability to run paid lookups. If your product needs OSINTverse data, ask the person for an API key or point them at MCP.