diff --git a/src/main/java/com/sitepark/ies/sharedkernel/security/AuthenticationContext.java b/src/main/java/com/sitepark/ies/sharedkernel/security/AuthenticationContext.java
index bf0d406..b06f126 100644
--- a/src/main/java/com/sitepark/ies/sharedkernel/security/AuthenticationContext.java
+++ b/src/main/java/com/sitepark/ies/sharedkernel/security/AuthenticationContext.java
@@ -1,4 +1,15 @@
 package com.sitepark.ies.sharedkernel.security;
 
+import org.jspecify.annotations.Nullable;
+
+/**
+ * Describes how a user was authenticated.
+ *
+ * @param providerId the id of the configured provider, {@code null} if the provider type has no
+ *     configurable instances (e.g. OIDC logins)
+ */
 public record AuthenticationContext(
-    AuthProviderType providerType, String providerId, AuthMethod method, String externalId) {}
+    AuthProviderType providerType,
+    @Nullable String providerId,
+    AuthMethod method,
+    String externalId) {}