Technical specifications

Reference, Scopes & Security

OpenID Connect scopes, JWT/UserInfo claims, OAuth 2.1 error codes, and rate limits.

1. Scopes & Claims Exposed to Third-Party Apps

Orneos enforces GDPR data minimization: only claims matching the scopes requested and approved by the user are returned.

Scope Returned Claims Description
openid sub, iss, aud, exp, iat, auth_time Stable unique identifier of the Orneos account (required).
profile name, preferred_username, picture Display name, Orneos username, and avatar URL.
email email, email_verified Account @orneos.eu email address (always verified).

2. OAuth 2.1 Error Codes

Code Primary Cause Recommended Action
invalid_request Missing parameter or missing S256 PKCE challenge. Ensure code_challenge and code_challenge_method=S256 are sent.
invalid_client Unknown client, wrong secret, or suspended application. Check your client_id and client_secret in the console.
invalid_grant Expired (> 120 s) or already-used code, wrong code_verifier, or revoked refresh token. Start a fresh authorization flow.
access_denied User declined consent or unverified app cap (10 users) reached. Submit your application for verification before production rollout.
rate_limited Too many requests from the same IP or client_id. Back off exponentially (HTTP 429).

3. Quotas & Rate Limits

  • Apps per account: up to 5 applications, up to 10 redirect URIs per application.
  • Unverified mode (sandbox): capped at 10 distinct users until the application is verified.
  • OAuth rate limits: 120 requests / 15 min on /oauth/authorize and 60 requests / 15 min on /oauth/token and /oauth/revoke per (IP, client) pair.
  • Token lifetimes: authorization code 120 s · access_token 3600 s (1 h) · refresh_token 90 days (rotated on every use).