Enhance Security and Trust: New Session Metadata in Sign in with Google- Google Developers Blog

What this post added

Introduced new OpenID Connect (OIDC) claims, `auth_time` and `amr`, to the ID Token for Sign in with Google. `auth_time` indicates the last successful authentication time with Google, and `amr` provides a reference to the authentication methods used (e.g., password, MFA, hardware key). These claims enable developers to implement more dynamic, risk-based access controls and enhance security by providing insights into the user's Google session freshness and authentication strength.