Google Adds Session Metadata to Sign-in to Strengthen Authentication Security

Google is rolling out two new session metadata claims for Sign in with Google, designed to help developers build stronger, more granular security policies around user authentication.

The features—auth_time and amr (Authentication Methods Reference)—are now available to verified apps via OpenID Connect (OIDC) standard claims. They appear in the ID Token that backend systems receive, giving platforms visibility into both when a user last authenticated with Google and how they did it.

Why This Matters#

Static authentication policies struggle against today's threats. These new claims enable developers to implement dynamic, risk-based session controls that can:

• Identify session freshness. auth_time is a timestamp showing the last successful authentication with Google, separate from when tokens were issued. Platforms can enforce re-authentication for sensitive actions if sessions grow stale.
• Assess authentication strength. amr is a JSON array indicating which methods the user employed—passwords, multi-factor authentication (MFA), hardware keys, software keys, phone, or SMS. Developers can deny access to critical functions unless stronger methods (e.g., hwk for hardware security keys) were used.

Practical Applications#

Developers can use these claims for:

• Audit logging of authentication methods on sensitive operations
• Step-up authentication challenges within apps for high-risk actions
• Authorization policies that require MFA or security keys for admin functions

The claims work across Android, iOS, and web applications. Existing Sign in with Google implementations using OIDC can request them via the standard claims parameter in authentication requests—no major flow redesign needed.

Visit Google Identity developer documentation for integration examples across platforms.