OpenID Connect

OpenID Connect (OIDC) is an identity layer on top of OAuth 2.0 that provides user authentication and identity information, and it is the de facto standard for SSO.

Purpose

It adds standardized user authentication and identity claims on top of OAuth's authorization.

Mechanism

Building on OAuth 2.0, it adds the ID Token (a JWT carrying user identity claims) and a UserInfo endpoint. The scope openid triggers OIDC. The ID Token carries claims such as sub, iss, aud, and exp. Discovery is supported via .well-known/openid-configuration.

Use cases

Cross-domain SSO login
Third-party identity verification
Enterprise identity federation
Mobile authentication

Examples

Input

scope=openid → ID Token

Output

A JWT carrying the user's identity

Authentication plus authorization

Common errors

Confusing OAuth (authorization) with OIDC (authentication): Remember: OIDC = OAuth plus an identity layer

Related terms

OAuth 2.0 is an authorization framework that lets third-party applications access a user's resources with the user's consent, without sharing passwords, by using tokens.

JWT (JSON Web Token) is a compact, self-contained token that securely conveys claims as a JSON object, widely used for stateless authentication and information exchange.

A Bearer token is a token type that works purely by possession: it is sent in the Authorization: Bearer <token> header, so whoever holds it can use it, with no additional credentials.

References