diff --git a/app/api/auth/callback/route.ts b/app/api/auth/callback/route.ts
index 5a01f1c..c784ca2 100644
--- a/app/api/auth/callback/route.ts
+++ b/app/api/auth/callback/route.ts
@@ -50,8 +50,8 @@ export async function GET(request: NextRequest) {
   }
 
   try {
-    const { idToken } = await exchangeCode(config, code, stored.verifier);
-    const verified = await verifyIdToken(config, idToken, stored.nonce);
+    const { idToken, accessToken } = await exchangeCode(config, code, stored.verifier);
+    const verified = await verifyIdToken(config, idToken, stored.nonce, accessToken);
     const session = await signSession({
       sub: verified.sub,
       tenantId: verified.tenantId,
diff --git a/lib/oidc.ts b/lib/oidc.ts
index 8c5cdeb..ff8338d 100644
--- a/lib/oidc.ts
+++ b/lib/oidc.ts
@@ -128,6 +128,7 @@ export async function verifyIdToken(
   config: OidcConfig,
   idToken: string,
   expectedNonce: string,
+  accessToken?: string,
 ): Promise<VerifiedIdToken> {
   const { payload } = await jwtVerify(idToken, keySet(config.issuer), {
     issuer: config.issuer,