[3 Sep 2026] Upcoming OIDC Conformance Updates for Corppass Integrations

Dear Partners,

We would like to provide advance notice of several upcoming OpenID Connect (OIDC) conformance updates to Corppass. These changes are intended to improve standards compliance and interoperability with OIDC client libraries.

These changes have been deployed to the Staging environment and will be rolled out to Production on 1 October 2026.

What is changing

1. ID Token lifetime reduced to 10 minutes

For both the Corppass Financial-grade API (FAPI) 2.0 and Legacy API integrations, the lifetime of ID tokens will be reduced from 1 hour to 10 minutes. 

If your implementation stores ID tokens and validates them after the authentication flow has completed, you should review it to ensure it correctly handles the shorter token lifetime.

2. Userinfo JWS payload `sub` claim will return the entity ID instead of the client ID

For Corppass FAPI 2.0 integrations, the `sub` claim in the JSON Web Signature (JWS) payload returned by the Userinfo (/userinfo) endpoint will be updated to return the entity ID, matching the `sub` claim in the ID token.

If your implementation currently expects the client ID in this claim, you should review and update it accordingly.

3. Encrypted Userinfo JWE protected header will include the `cty: "JWT"` parameter 

For Corppass FAPI 2.0 integrations, the protected JSON Web Encryption (JWE) header of the Userinfo (/userinfo) endpoint response will be updated to include the `cty` parameter with the value “JWT”. 

If your implementation parses or validates the JWE protected header, you should ensure it correctly handles the presence of this additional header parameter. Standards-compliant client libraries should already support this change.

If you have any questions or require assistance, please contact our support team here.

Thank you for your continued partnership and support.

Best regards,
Corppass Team