Auth

OpenID Connect

An authentication layer on top of OAuth 2.0: the client receives an ID token with user information.

Official site

What it is

OpenID Connect (OIDC) adds the answer to "who is this" on top of OAuth 2.0. Besides the access token the provider returns an ID token as a JWT with the user identifier and login time.

The standard defines the openid scope, a userinfo endpoint, a discovery document at /.well-known/openid-configuration and a set of standard claims (sub, email, name).

OIDC is what stands behind "Sign in with Google" buttons and corporate SSO on Entra ID, Okta or Keycloak.

Use it when

  • User sign-in through an external provider (social login).
  • Single sign-on (SSO) for several company apps.
  • You need standard, interoperable authentication.

Avoid it when

  • Only API access authorization with no need to know the user: OAuth 2.0 is enough.
  • A very simple app where your own passwords and sessions suffice.

Key concepts

ID token
A JWT signed by the provider with facts about the authentication.
Claims
User fields: sub, email, name.
Discovery
.well-known/openid-configuration listing all provider endpoints.
Nonce
A random value against token replay.

Example

Decoded ID token claims.

Interview questions

  1. 1. How does an ID token differ from an access token?

    The ID token is for the client and says who the user is. The access token is for the API and says what is allowed. Do not send the ID token to an API as a permission.

  2. 2. What do you verify in an ID token?

    The signature (keys from JWKS), iss, aud, exp and nonce. Without these checks the token cannot be trusted.

  3. 3. What is /.well-known/openid-configuration for?

    The client discovers endpoint URLs, supported scopes and the JWKS automatically. That simplifies connecting any provider.

Related technologies

Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).

Explore the platform