How can I get an id_token from an access_token?

Is the application requesting a token a single page application using implicit mode (response_type is token, id_token or token id_token?). If so, the limit is set at 3.5 K because the response is delivered in a Location header for the redirection to the callback URL, and some browsers limit the length of headers. There’s no way around it unless, except a change in architecture like the one you mentioned above.

If you are using an authorization code flow or hybrid flow (used in regular web apps or native applications, or if you put a back end to your SPA receive and keep the tokens using an authorization code exchange), the limit is removed because the browser does not limit these exchanges.

1 Like