acr (Authentication Context Class Reference) Claim

acr is a single string identifying the level of assurance the authentication reached. OpenID Connect deliberately does not define a vocabulary beyond one special case: the value 0 means the authentication did not meet even ISO 29115 level 1, typically a long lived browser cookie, and the specification says such a session must not be accepted for a monetary transaction. Everything else is a name the parties agree on privately.

That is why the claim is easy to misread. Two providers can both emit acr and mean nothing alike; one uses URNs from an assurance framework, another uses short labels of its own invention. A relying party has to hold a list of the exact strings its provider issues and which of them it is willing to accept, and that list has to be revisited whenever the provider changes its authentication options.

A request can ask for a specific level using acr_values, or as an essential claim in the claims request parameter. The distinction matters: acr_values is a hint the provider may ignore, while an essential claim request is a stronger statement. Either way the outcome is only known by reading the acr in the returned token, so the comparison on the relying party side is what actually enforces the policy.

Where acr says how strong the authentication was, amr says which methods were used, and the two are often returned together. The decoder shows acr under Custom claims as a plain string. It cannot rank it, because there is no ranking to apply: interpreting the value requires the provider's documentation, not the token.