Integrating with CID

CID is a standard OpenID Connect provider with pairwise subject identifiers. Use any OIDC library with the discovery document. Authorization code + PKCE (S256) is required. Request scope openid profile cid.

Custom claims

cid_score_range   string bucket: "0-19" | "20-39" | "40-59" | "60-79" | "80-100"
                  (exact score is never shared with RPs; users see it on their dashboard)
cid_verifications array of passed checks: account, card_name_match, postcard, document, connected_account, human_behavior, manual_review
cid_profile       URL of the public profile (HTML; append .json for JSON)
cid_needs_reverify boolean, true while any site's flag is open
sub               pairwise per client — different at every RP

Agent tokens

Users mint agent tokens in their dashboard. They are ES256 JWTs with header typ: cid-agent+jwt, claims sub (pairwise for the audience), aud, scope, exp, jti, cid_token_type: "agent" and act: {sub, name} (RFC 8693 actor). Always call:

POST /agent/verify   (client_secret_basic)
token=<agent jwt>&required_scope=comments:write
→ {"active":true,"token_type":"agent","sub":"ps_…","act":{…},"cid_score_range":"60-79",…}

Revocation

Register a backchannel_logout_uri to receive a signed logout+jwt with the sid when the user revokes your app. You can also call /introspect.

Email claims

The email scope yields email_verified. The email address itself is included only when the user has verified it (magic-link click).

Flagging

POST /api/flag  (client_secret_basic)  sub=<pairwise sub for this client>&reason=…