---
title: "Enhance Security and Trust: New Session Metadata in Sign in with Google"
description: "Sign in with Google now provides verified applications with two OpenID Connect session metadata claims, auth_time and amr, in ID tokens. auth_time records the last successful Google authentication time, distinguishing session freshness from token issuance, while amr is a JSON array identifying authentication methods such as pwd, mfa, hwk, swk, tel, and sms. The claims are available across Android, iOS, and web client and server applications, and can support audit logging, step-up authentication based on session age, and authorization rules requiring stronger methods for sensitive operations. Verified applications request them through the standard OIDC claims parameter without significantly changing an existing Sign in with Google authentication flow."
---

# Enhance Security and Trust: New Session Metadata in Sign in with Google

[Google](https://yomu.fyi/company/google) · Sergei Akulich, Brian Daugherty · Jun 16, 2026

**Type:** Announcement

## Summary

Sign in with Google now provides verified applications with two OpenID Connect session metadata claims, auth\_time and amr, in ID tokens. auth\_time records the last successful Google authentication time, distinguishing session freshness from token issuance, while amr is a JSON array identifying authentication methods such as pwd, mfa, hwk, swk, tel, and sms. The claims are available across Android, iOS, and web client and server applications, and can support audit logging, step-up authentication based on session age, and authorization rules requiring stronger methods for sensitive operations. Verified applications request them through the standard OIDC claims parameter without significantly changing an existing Sign in with Google authentication flow.

## Context

The claims address phishing, online abuse, account takeover, fake account usage, and other fraudulent activities by giving applications more detailed signals about when and how a user authenticated with Google.

## Approach / What changed

Verified applications can request the auth\_time and amr OIDC claims in the ID token through the standard claims parameter in an existing Sign in with Google authentication request. Applications can use the signals for session, audit, step-up authentication, and authorization decisions.

## Takeaways

- auth\_time indicates the last successful Google authentication that created the session, rather than the time an ID token or access token was issued.
- amr identifies authentication methods used during the session, including password, MFA, hardware-secured key, software-secured key, phone, and text message.
- Applications can use session age and authentication method data for audit logging, step-up authentication, and policies such as requiring mfa or hwk for critical administrator functions.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [OIDC](https://yomu.fyi/topic/oidc), [Security](https://yomu.fyi/topic/security)

- Source: [Google](https://developers.googleblog.com/enhance-security-and-trust-new-session-metadata-in-sign-in-with-google)
- Source URL: https://developers.googleblog.com/enhance-security-and-trust-new-session-metadata-in-sign-in-with-google
- Ingested by Yomu: 2026-09-09T14:29:39.768Z

[Read original post](https://developers.googleblog.com/enhance-security-and-trust-new-session-metadata-in-sign-in-with-google)