# Scopes and claims

Sites ask for scopes, and signo returns the claims that belong to them, after the person has allowed it.

| Scope | Claims | Notes |
|---|---|---|
| `openid` | `sub` | Required. A random ID for the account, the same for every site. |
| `email` | `email`, `email_verified` | `email_verified` is always `true`: accounts exist only after their email link is used. |
| `profile` | `name` | Only when the person has given a name. |

signo puts these claims in the ID token, as Google does, and returns them from the userinfo endpoint (`/me`) too. Libraries such as Auth.js read them from the ID token. The ID token also carries the standard claims your library checks, such as `iss`, `aud` and `exp`.

## What the person sees

The consent screen names the domain the person will return to, then lists what the site receives: their email, their name if the site asked for `profile`, and an ID for their signo account. They allow it once per site; signo remembers that for up to a year.

## Not supported

- Scopes other than `openid`, `email` and `profile`
- The `claims` request parameter
- Pairwise subject identifiers: every site receives the same `sub` for a person