# Support for id\_token\_hint to avoid login flow again

**URL:** <https://forum.keycloak.org/t/support-for-id-token-hint-to-avoid-login-flow-again/5103>\
**Category:** Getting advice\
**Tags:** oidc\
**Created:** [September 29, 2020, 3:58pm UTC](https://forum.keycloak.org/t/support-for-id-token-hint-to-avoid-login-flow-again/5103 "2020-09-29T15:58:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sagarshah1983](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/sagarshah1983/32/1452_2.png) [@sagarshah1983](https://forum.keycloak.org/u/sagarshah1983)\
**Post date:** [September 29, 2020, 3:58pm UTC](https://forum.keycloak.org/t/support-for-id-token-hint-to-avoid-login-flow-again/5103/1 "2020-09-29T15:58:18Z")

</div>

Does keycloak support id\_token\_hint?  
If user is already authenticated on keycloak auth server, and on click of some link within the system, if Authorization needs to happen again for the same user on auth server, can we somehow bypass login flow?  
I am trying to use prompt=none and passing id\_token\_hint value with previously received id\_token from auth server and session\_state value received earlier, but that’s giving me login\_required error from keycloak on the app redirect url when getting authorization code.

Here’s the example URL:  
[http://keycloak:9080/auth/realms/igia/protocol/openid-connect/auth](http://keycloak:9080/auth/realms/igia/protocol/openid-connect/auth)?  
client\_id=sagar-test  
&redirect\_uri=http%3A%2F%2F127.0.0.1%3A9010%2Fcallback  
&response\_type=code  
&scope=openid+launch  
&state=bbb  
&prompt=none  
&session\_state=894b7695-de61-4cd0-b1d0-9509ae65fd0d  
&id\_token\_hint=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJlYlZwVmkyaVV5anpXWTVaWHMzRE80b3RZaVJibDJpbE11N3BrYXo5RWpJIn0.eyJqdGkiOiI3M2UyOGIyNC1kM2RjLTQ0YmYtYmVmNy1lODg4YTM0NzM0ZjAiLCJleHAiOjE2MDEzOTQ4OTAsIm5iZiI6MCwiaWF0IjoxNjAxMzk0MjkwLCJpc3MiOiJodHRwOi8va2V5Y2xvYWs6OTA4MC9hdXRoL3JlYWxtcy9pZ2lhIiwiYXVkIjoic2FnYXItdGVzdCIsInN1YiI6IjRjOTczODk2LTU3NjEtNDFmYy04MjE3LTA3YzVkMTNhMDA0YiIsInR5cCI6IklEIiwiYXpwIjoic2FnYXItdGVzdCIsImF1dGhfdGltZSI6MTYwMTM5NDI4OSwic2Vzc2lvbl9zdGF0ZSI6Ijg5NGI3Njk1LWRlNjEtNGNkMC1iMWQwLTk1MDlhZTY1ZmQwZCIsImFjciI6IjEiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwibmFtZSI6IkFkbWluIEFkbWluaXN0cmF0b3IiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhZG1pbiIsImdpdmVuX25hbWUiOiJBZG1pbiIsImZhbWlseV9uYW1lIjoiQWRtaW5pc3RyYXRvciIsImVtYWlsIjoiYWRtaW5AbG9jYWxob3N0In0.Yqi0N7ilYsr\_fP\_-7qWiTDbaiLTBRbW3p-w07D33w8LbIbhqxRHAi5FYwcYOo5HQffcjmcRetYUHBSExVpyRl0YrHON6\_g02x1UJurMZPwGbDiTRMf4\_xiRvDM18TnZuQEGCvN0s8xtm5wqv2jKqWSyRD6RktYZKuLssaH-wp20nryBTRv87M6-Nh1MfHa4m-Xv5nw4t\_y6LWNPurwGUZRwsPGAIxeN8anFjxdf4kYUQD44etc4y1ZijZZ8lCWoSW4RWSblM7iaalqdjsVqx7fUeTXTpRptZJZiasaqT7O08Z2lN1zsA4sFHc8UgFqvIKq\_2tExnNAI1A4FwGh-Kpw

Any help is appreciated!

---

<div class="post-metadata">

**Author:** ![Robbilie](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/robbilie/32/2283_2.png) [@Robbilie](https://forum.keycloak.org/u/Robbilie)\
**Post date:** [February 3, 2021, 7:47pm UTC](https://forum.keycloak.org/t/support-for-id-token-hint-to-avoid-login-flow-again/5103/2 "2021-02-03T19:47:17Z")

</div>

I would be interested in this as well, specifically for the use case of not having to log in again in the account console

---

<div class="post-metadata">

**Author:** ![fidgi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/fidgi/32/92_2.png) [@fidgi](https://forum.keycloak.org/u/fidgi)\
**Post date:** [February 13, 2021, 10:16am UTC](https://forum.keycloak.org/t/support-for-id-token-hint-to-avoid-login-flow-again/5103/3 "2021-02-13T10:16:13Z")

</div>

Hi,  
I’m also interested in knowing whether Keycloak is supporting this as per OpenID Connect specification.  
OpenID Connect requires that if the ID token is sent encrypted by the OP, the ID token has to be re-encrypted by the client app, with its own key shared with the OP. So an additional question, is whether Keycloak allows to use the client secret for this purpose.

Regards,

---

<div class="post-metadata">

**Author:** ![ecostanzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ecostanzi/32/8188_2.png) [@ecostanzi](https://forum.keycloak.org/u/ecostanzi)\
**Post date:** [August 8, 2024, 8:21am UTC](https://forum.keycloak.org/t/support-for-id-token-hint-to-avoid-login-flow-again/5103/4 "2024-08-08T08:21:59Z")

</div>

Hi there I’m interested as well in understanding if prompt=none&id\_token\_hint= is supported by Keycloak.

In the documentation if found a mention only in logout section [Securing Applications and Services Guide](https://www.keycloak.org/docs/23.0.7/securing_apps/#logout)