What your app receives
The profile of the person who signed in, and how to treat the user id.
What your site gets
| Claim | Meaning |
|---|---|
sub | Identifies the person. Use it as the key of your user table (never the username: people can change it). |
username | Public UNET username. Can change; show it, do not key on it. |
display_name | Display name, if the person set one. |
picture | https URL of the avatar image, if there is one. (Avatars of private accounts are not served to the public.) |
account_created_at | When the UNET account was created (a trust signal). |
The profile claims come from the userinfo endpoint (https://api.unet.ovh/oidc/me) with the access token, not from the ID token. There is no email address: UNET accounts have none, and the site never sees a password or keys. (avatar is an internal storage key kept for older apps; use picture.)
The user id (sub)
A plain sign-in app gets a different id per site by default: the same person always has the same sub on your site, but another one on every other site, and it is not the UNET user id. Two sites cannot match a person by comparing ids. Apps that use the REST API (its data carries real UNET user ids) get the UNET user id instead; either can be chosen under Advanced when creating the app, and cannot be changed afterwards, because that would change every person's id on your site. Apps on one domain share the same ids.