What probably matters to youSection of the release
Unclear Whether tokens must still include a sub claim when oidc.user_id_claim names a different one is not settled.
What
OIDC is a standard way of signing users in, and the sign-in token it produces carries fields called claims. Claude Code's gateway used to take the user ID straight from the sub claim. It now reads it from the claim named in the new oidc.user_id_claim setting, and uses sub when that setting is not given.
If the named claim is missing from a token, the gateway stops with an error coded USER_ID_CLAIM_MISSING.
Why
Operators can now identify users by a field other than sub, which helps when their sign-in provider puts the useful ID somewhere else.
Read from
Names in the bundleoidc.user_id_claim
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtWhether tokens must still include a `sub` claim when `oidc.user_id_claim` names a different one is not settled.
Anthropic's release notes agreeAdded oidc.user_id_claim to the Claude apps gateway, to identify people by an id_token claim other than sub, such as Microsoft Entra ID's…
