A typical user doesn't need (or can use) the id_token that's returned in /v1/login response. There has been confusion with some users as to its use and some have tried using it in requests instead of access_token, which obviously causes them problems. Simplification here can resolve that issue.

Acceptance criteria

• /v1/login/ default response should no longer include id_token

ToDo

• give advance notice to customers and check impact
• update v1/login endpoint response to no longer return id_token
• update docs page (CMS): /docs/ "Login Response" example will need to be updated
• update /docs/authentication/ page (ENG deploy):
  • #login will need to be updated accordingly
  • #refresh-token response example updated
  • #new-password-required response example updated