amr (Authentication Methods References) Claim
amr is an array of short strings naming the authentication methods used for the login, such as pwd or otp. RFC 8176 registers a common vocabulary, but providers may emit values outside it.
At a glance
- Claim
- amr (Authentication Methods References)
- Defined in
- OpenID Connect Core 1.0 section 2, values registered by RFC 8176
- Value type
- Array of case sensitive strings
- Required
- Optional. Returned when requested or when the provider chooses to emit it.
- Sample value
- ["pwd", "otp"] for a password plus one time code login
- In the decoder
- Shown under Custom claims as decoded JSON, so an array stays an array rather than being joined into one string.
In detail
RFC 8176 exists because providers were inventing their own method names. It registers a vocabulary including pwd for a password, otp for a one time password, sms for a code sent by message, hwk for a proof of possession hardware key, swk for a software key, pin, face, fpt for a fingerprint, mfa to say that multiple factors were used, and user to say a human was physically present. Values outside the registry are still legal.
The list describes methods, not order or strength. An array containing pwd and otp says both were involved in this authentication; it does not say which came first, whether either was a step up, or how good the implementation is. The mfa value is a summary the provider asserts rather than something a relying party can derive by counting the other entries.
Used carefully it is genuinely useful: refusing a payment when amr contains only pwd, or requiring hwk before an administrative action, expresses a policy the token can carry. Used carelessly it becomes a guess, because a provider is free to add values, rename its own, or stop sending the claim entirely, and none of that breaks any specification.
The decoder renders amr under Custom claims as the JSON array it is, which is worth noting because the claim is one of the few array valued ones people meet regularly and flattening it hides how many methods were reported. It does not check the values against the RFC 8176 registry, so an unregistered provider specific string is displayed just as plainly as pwd.
Examples
{
"amr": ["pwd", "otp"],
"acr": "mfa",
"auth_time": 1735686000
}{
"amr": ["pwd", "hwk", "vendor:passkey_platform"]
}Only pwd and hwk are registered in RFC 8176. The third value means whatever the provider documents.
Things that catch people out
- Counting the entries to decide whether multi factor happened. Two values can both come from one factor, and the provider asserts mfa itself when it means it.
- Assuming every provider uses the RFC 8176 names. The registry is a convention, not a constraint, so pin your check to the strings your own provider actually emits.
- Reading amr as a strength ranking. It reports methods; acr is the claim that expresses a level.
Try it: JWT Decoder
Paste a token to decode the header and payload, read the claims and expiry, and verify the signature in your browser. Nothing is uploaded.
JWT Decoder
LOCAL · Browser-OnlyDecode and inspect JSON Web Tokens without sending them to a server
Related JWT claims and algorithms
All jwt claims and algorithms →acr (Authentication Context Class Reference) Claim
The acr claim states how strongly the user was authenticated. Why its values are provider specific, what the value 0 means, and how the decoder shows it.
auth_time Claim in an OpenID Connect ID Token
The auth_time claim records when the end user actually authenticated, not when the token was issued. How max_age uses it and how the decoder shows it.
nonce Claim in an OpenID Connect ID Token
The nonce claim binds an ID token to one authentication request. How the value round trips, why it must be compared, and how the decoder shows it.
at_hash (Access Token Hash) Claim in an ID Token
The at_hash claim ties an ID token to the access token issued with it. How the left half hash is computed, when it must be checked, and decoder limits.
c_hash (Code Hash) Claim in an ID Token
The c_hash claim binds an ID token to the authorization code returned with it. Where hybrid flows need it, how it is computed, and what the decoder shows.
sid (Session ID) Claim in a JWT
The sid claim identifies the authentication session at the provider. How single logout uses it, why it is not the user identifier, and decoder behaviour.
Tools for this
- JWT Decoder Free online JWT decoder - decode and inspect JSON Web Tokens without sending them to a server