Hi, Kesavan. I believe Michael's answer in the previous ticket was clear enough. Method actually used by OP to authenticate a user is returned in `id_token`, so RP/client can verify it is the one they expect. There is no way to specify list of acceptable methods per client at the moment. Feel free to submit a feature request at Github for it (though no ETA for such things unless it's a request from a customer). Your best solution for now seems to be the one Michael proposed - to use a signed request object, or pass request by reference.