In oauth2 the claim is it part of acess token

 In the strict OAuth 2.0 specification, claims are not a required component of an access token. However, in modern practice—especially when using OpenID Connect (OIDC)—claims are frequently included if the token is formatted as a JWT (JSON Web Token).

The presence of claims depends entirely on the token format chosen by the Authorization Server:

1. JWT Access Tokens (The Modern Standard)

Most modern identity providers (like Okta, Auth0, or AWS Cognito) issue access tokens as JWTs. In this scenario, yes, claims are part of the access token.

• Standard Claims: You will find claims like sub (subject/user ID), iss (issuer), exp (expiration), and iat (issued at).

• Authorization Claims: The scope claim is usually included to tell the Resource Server what the bearer is allowed to do.

• Custom Claims: Organizations often inject custom claims (e.g., tenant_id, org_unit, or user_role) to allow microservices to make authorization decisions without hitting a database.

2. Opaque Access Tokens

If the server issues an "opaque" token (a random string of characters), then no, claims are not part of the token itself.

• Internal Storage: The claims are stored in the Authorization Server's database, linked to that specific string.

• Retrieval: To see the claims, the Resource Server must use Token Introspection. It sends the opaque string to the Authorization Server, which then returns a JSON object containing the claims associated with that token.