OIDC authorization screen says app can access email when email is not requested

API
1

Hello, I’m using Twitch OpenID Connect for identity-only authentication in a tiny community app and my authorization request uses the authorization-code flow with: scope=openid

The only UserInfo claims I request are: preferred_username and picture

I don’t request email, email_verified, or the user:read:email scope as my app doesn’t use or store users’ email addresses. (code screenshot attached below)

However, Twitch’s authorization screen says:

“Authorizing will allow S-Kards TCG to:
Get your Twitch user ID, username, profile image, profile update date, email address, and email verification status.” (auth screen screenshot attached below)

This is confusing because it suggests the app can access the users’ email addresses, even though I don’t request the relevant claims or scope. Is this wording shown for all openid authorization requests, or should the consent screen reflect the requested claims and scopes? If it’s intentional, is there a supported identity-only flow that lets an app authenticate a Twitch user and access their public profile information without saying it can access their email address?

I’m trying to request the minimum access possible and have the consent screen accurately reflect that.

Thanks.

authcodescreenshot
authcodescreenshot651×343 8.3 KB

skardauth
skardauth1170×1391 156 KB

2

Known issue OAuth 2.0 authorization dialog shows unrequested scope email address, email confirmation status etc. · Issue #808 · twitchdev/issues · GitHub

3

Use not OIDC and request no scopes

But TBH, however, I would get a users email and check that it’s verified to reduce “spam” users accessing things (and/or checking the account is “healthy” and “trusty” since the email is verified)