OpenID Foundation approves Ephemeral Subject Identifier 1.0 as a Final Specification
OpenID Foundation members approved OpenID Connect Ephemeral Subject Identifier 1.0 as a Final Specification, announced October 8, 2026: 79 approve, 4 object, 19 abstain. The subject_type that changes every session is now fixed text.
What happened
On October 8, 2026, the OpenID Foundation announced that its members had approved OpenID Connect Ephemeral Subject Identifier 1.0 as a Final Specification. The tally was 79 approve, 4 object and 19 abstain. 102 of 435 members voted (23.4%), above the 20% quorum. The vote itself closed on September 30, 2026; see the earlier item on the vote.
A Final Specification is not subject to further revision, and the Foundation's Final status provides intellectual property protections to implementers. Key points of the final text, some of which are more specific than our summary at the vote:
- The ephemeral sub remains constant for the duration of the authentication session, and later visits get a different value.
- The OP returns it in the ID Token and the UserInfo response, as specified by OIDC Core.
- The OP must not reuse a value, must generate it with a guessing probability of 2^-128 or less, and should target 2^-160 or less, using a cryptographically secure source of randomness.
- The spec says nothing about refresh tokens or logout.
Why it matters
Identity providers now have a stable target. Until approval, an OP adding ephemeral to subject_types_supported was implementing a draft that could still change. That excuse is gone, so support can be asked for in RFPs and roadmaps.
Deepak's take
Final status does not mean support. As of this update we know of no CIAM vendor profiled in CIAM Compass that advertises ephemeral in its discovery document. Expect the first implementations in privacy-focused and government-adjacent providers, where unlinkable attribute checks such as age-over-threshold are a stated requirement, before general CIAM platforms.
What to do
- Relying parties: if you only need an attribute, not an account, ask your OP for a date on ephemeral support and check subject_types_supported rather than a sales answer.
- Identity providers: the spec is silent on refresh tokens and logout, so document your behaviour there, and size generation to the 2^-128 guessing requirement, before advertising support.
- Further reading: the OIDC subject identifiers guide compares public, pairwise and ephemeral.