Cybersecurity glossary
What is an ID Token?
Learn what an OpenID Connect ID token is, how it differs from OAuth access tokens, which claims to validate, and security practices that prevent ID token misuse.
Definition
An ID token is a security token—typically a signed JWT—issued by an OpenID Connect provider to a client to assert that a user has authenticated, including subject and authentication metadata the client can verify.
Why OIDC needed a dedicated identity token
OAuth access tokens answer “what may this client do at an API?” Applications also need a clear answer to “who just signed in?” The ID token carries that authentication assertion to the client in OpenID Connect.
Confusing ID tokens with access tokens is one of the most common OIDC implementation mistakes.
What an ID token contains
iss (issuer)
Identifies the OpenID provider that minted the token.
sub (subject)
Stable identifier for the authenticated user at that issuer.
aud (audience)
Must include your client ID; reject tokens aimed elsewhere.
exp / iat
Validity window; never accept expired identity assertions.
nonce
Binds the token to the authentication request/session.
auth_time / acr
When and how strongly the user authenticated—useful for step-up.
Where the ID token fits in the flow
Client starts OIDC login
Authorization request includes OpenID scopes and a nonce.
User authenticates at the IdP
Primary factors and MFA complete at the OpenID provider.
Tokens returned to client
Authorization code exchange yields ID token plus access token (and maybe refresh).
Client validates ID token
Cryptographic and claim checks establish the user identity locally.
Access token used at APIs
Resource servers authorize with the access token—not the ID token.
ID token vs access token
| Topic | ID token | Access token |
|---|---|---|
| Primary audience | OAuth client / RP | Resource server / API |
| Purpose | Prove user authentication | Authorize API operations |
| Typical format | JWT | JWT or opaque |
| Send to APIs? | Usually no | Yes |
Validation and handling checklist
- Verify signature against the issuer’s JWKS; reject alg=none and unexpected algorithms.
- Check iss, aud, exp, and iat with small allowed clock skew.
- Compare nonce to the value stored for the login session.
- Do not use ID tokens as general-purpose API bearer credentials.
- Minimize PII in ID token claims; prefer UserInfo when needed.
- Protect tokens in transit and at rest; prefer server-side session patterns for browsers.
- Use auth_time / acr for step-up decisions on sensitive actions.
- Log authentication success with subject and issuer—not full token contents.
The practical takeaway
An ID token is the OIDC proof of authentication delivered to your application. Validate it carefully, then authorize APIs with access tokens that were minted for those APIs.
Keep identity assertions and API credentials in their lanes—that separation is what makes OpenID Connect safer than overloaded custom JWTs.
Related security terms
OpenID Connect (OIDC)
Identity layer that defines ID tokens.
OIDC `nonce`
Claim used to bind an ID token to a client session and prevent replay.
JWT (JSON Web Token)
Common format used to encode ID tokens.
Bearer Token
How many access tokens are presented—distinct from ID token purpose.
Identity Provider (IdP)
Issues ID tokens after authenticating the user.
Frequently asked questions
What is an ID token in simple terms?
It is a signed statement from your login provider saying ‘this user signed in,’ meant for the application that requested login—not as a general API key.
How is an ID token different from an access token?
An ID token proves authentication to the client (identity). An access token authorizes calls to a resource server (API access). Do not send ID tokens as API bearer credentials unless a rare, explicit profile requires it.
What format is an ID token?
Usually a signed JWT containing claims such as iss, sub, aud, exp, iat, and optionally nonce, auth_time, and profile attributes.
What must clients validate on an ID token?
Signature and JWKS, issuer, audience (client ID), expiration, and nonce when used; also azp and auth_time when your threat model requires them.
Can APIs accept ID tokens for authorization?
Generally no. Resource servers should expect access tokens with appropriate audience and scopes. Mixing the two creates confused-deputy and replay problems.
Why does nonce matter?
Nonce ties the ID token to the browser session that started login, mitigating certain replay and injection attacks against the client.
Are ID tokens encrypted?
Often only signed. Encrypt ID tokens when claims are sensitive and the delivery channel or storage could expose them to unintended parties.
References
Explore authoritative guidance and frameworks related to id token.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.