Scopes and claims

Sites ask for scopes, and signo returns the claims that belong to them, after the person has allowed it.

Scope	Claims	Notes
`openid`	`sub`	Required. A random ID for the account, the same for every site.
`email`	`email`, `email_verified`	`email_verified` is always `true`: accounts exist only after their email link is used.
`profile`	`name`	Only when the person has given a name.

signo puts these claims in the ID token, as Google does, and returns them from the userinfo endpoint (/me) too. Libraries such as Auth.js read them from the ID token. The ID token also carries the standard claims your library checks, such as iss, aud and exp.

What the person sees

The consent screen names the domain the person will return to, then lists what the site receives: their email, their name if the site asked for profile, and an ID for their signo account. They allow it once per site; signo remembers that for up to a year.

Not supported

Scopes other than openid, email and profile
The claims request parameter
Pairwise subject identifiers: every site receives the same sub for a person