diff --git a/authlib/integrations/base_client/sync_app.py b/authlib/integrations/base_client/sync_app.py index 38f5df84..3716c0dd 100644 --- a/authlib/integrations/base_client/sync_app.py +++ b/authlib/integrations/base_client/sync_app.py @@ -254,7 +254,7 @@ def _create_oauth2_authorization_url(client, authorization_endpoint, **kwargs): log.debug('Using code_verifier: {!r}'.format(code_verifier)) scope = kwargs.get('scope', client.scope) - if scope and scope.startswith('openid'): + if scope and 'openid' in scope.split(): # this is an OpenID Connect service nonce = kwargs.get('nonce') if not nonce: