Home / Knowledge hub / OpenID Connect
Knowledge hub
OpenID Connect
A sign-in layer on top of OAuth that tells your app who the user is.
What it means
OpenID Connect, or OIDC, is a sign-in standard built on top of OAuth 2.0. OAuth by itself says what an app may access. OIDC adds the missing part: a signed ID token that tells your app who just signed in, issued by an identity provider you trust.
The ID token is a JSON Web Token with claims such as the issuer, the audience, the subject (a stable user id), an expiry and the time of sign-in. Your app uses it to start a session. The access token is for calling APIs, and the two should not be confused.
Why it matters
Most modern sign-in buttons use it, as do many business single sign-on setups. It lets customers use their own company accounts without you storing their passwords. That is good for security and for deals, but your app now depends on checking the token properly.
If it does not, the result is account takeover with no password involved. Tokens from the wrong provider, for the wrong app, or already expired may be accepted. Treating the access token as proof of identity is another real source of bugs.
How it shows up
You meet OIDC in the libraries and gateways that handle sign-in. Your app redirects the person to the provider, gets back a code, and exchanges it for tokens, usually with PKCE. The libraries should verify the ID token, but custom code and mis-set options skip steps.
Check that the signature is verified against the provider's published keys, that iss and aud match what you expect, that exp has not passed, and that the nonce you sent comes back. Also key users by the sub claim plus issuer, not by email alone, because emails can change or be unverified.
Questions people ask
OpenID Connect, answered
Is OpenID Connect the same as OAuth?
No. OIDC is built on OAuth 2.0 and adds identity. OAuth answers what an app may do. OIDC answers who the person is.
What is the difference between an ID token and an access token?
The ID token is for your app, to learn who signed in. The access token is for an API, to authorise a request. Do not use one in place of the other.
What is the nonce in OpenID Connect?
It is a value your app sends at the start of sign-in and must find unchanged in the ID token. It ties the token to that request and helps against replay.
Should we identify users by email?
Not on its own. Use the issuer and sub claim as the key, as emails can be changed, reused or unverified, and a provider may allow any value.
How do we test an OIDC integration?
Send tokens that are expired, signed with another key, issued to a different audience, or from another issuer, and confirm each is refused. Also test a replayed token.
Sources
Where this comes from
Related
Terms that sit next to this one
Single sign-on
One company identity for many applications, granted and removed in one place.
JWT
A signed token a client carries to prove who is signed in.
SAML
An older XML standard for single sign-on between a company and its apps.
PKCE
An extra check that stops a stolen OAuth code from being swapped for a token.
Identity provider (IdP)
The service that signs people in and tells your app who they are.
Does your app check who signed in?
We test sign-in and token handling for accepted tokens that should have been refused, and report what we proved with the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.