OptionalemailPrimary email address, when included in the access token.
OptionalemailWhether WorkOS has verified WorkOSOAuthUser.email.
OptionalfirstGiven name, when included in the access token.
WorkOS subject identifier.
OptionallastFamily name, when included in the access token.
OptionalnameDisplay name, when included in the access token.
OptionalorganizationActive WorkOS organization identifier.
OptionalpictureProfile image URL, when included in the access token.
OptionalpreferredPreferred username, when included in the access token.
Roles from the access token's roles claim.
OptionalsessionWorkOS session identifier.
Verified WorkOS user and organization claims exposed to authenticated MCP callbacks.