Skip to content

${PD-1926} Remove docs regarding max_age param #7345

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amontenegro merged 1 commit into from
Feb 24, 2026
+1 −2
Merged

${PD-1926} Remove docs regarding max_age param #7345

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions orcid-web/ORCID_AUTH_WITH_OPENID_CONNECT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ This means that ORCID:

* Embeds signed id tokens within token responses for authorization codes generated with the 'openid' scope
* Supports the implicit flow when using 'token' or 'id_token token' response_types and the 'openid' scope.
* Supports the 'prompt', 'nonce' and 'max_age' parameters for authorisation requests that include the 'openid' scope.
* Supports the 'prompt' and 'nonce' parameters for authorisation requests that include the 'openid' scope.
* Supports Openid Connect discovery and userinfo endpoints
* The payload from the id_token now contains a new data field called “amr” in which the value is “mfa” for users who have enabled two-factor authentication on their ORCID account, and “pwd” for users who haven’t. ( This data is not returned by the Public API only the Member API)

Expand Down Expand Up @@ -97,7 +97,6 @@ ORCID now supports the following behaviour during authorization requests that in
* **error=login_required** : the user does not have an ORCID session
* **error=interaction_required** : the user has not granted required permissions
* **prompt=login** : If the user is already logged in, force them to reauthenticate
* **max_age=seconds** : If the user logged in over max_age seconds in the past, force them to reauthenticate
* **nonce=String** : This nonce will be returned in the id_token.

## **Other endpoints**
Expand Down