Cybersecurity glossary
What is OpenID Connect (OIDC)?
Learn what OpenID Connect (OIDC) is, how it adds authentication and ID tokens on top of OAuth 2.0, how it enables SSO-style login, and which security checks keep OIDC deployments safe.
Definition
OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that enables clients to verify end-user identity based on authentication performed by an authorization server and to obtain basic profile information via standardized ID tokens and UserInfo endpoints.
Why OpenID Connect matters
OAuth alone answers “what may this client access?” Applications also need a standard answer to “who just logged in?” OpenID Connect (OIDC) adds that identity layer: ID tokens, standardized claims, discovery metadata, and UserInfo—built on OAuth 2.0 flows teams already know.
OIDC underpins many consumer social logins and enterprise workforce SSO replacements for older protocols. Getting token validation wrong turns “Sign in with IdP” into account confusion or takeover.
How OIDC relates to OAuth
| Topic | OAuth 2.0 | OIDC |
|---|---|---|
| Primary goal | Delegated authorization | Authentication + identity claims |
| Key credential | Access token (and refresh) | ID token (plus OAuth tokens as needed) |
| Typical consumer | Resource servers / APIs | Relying party applications (clients) |
| User profile | Not standardized | Standard claims + optional UserInfo |
Typical OIDC login flow
Client starts authentication
Redirect to the OpenID Provider with OIDC scopes such as openid profile email and a nonce.
User authenticates at the OP
Password, MFA, or passkeys verify the user according to IdP policy.
Authorization code returns
The OP redirects back to the client with a code (authorization code + PKCE recommended).
Token endpoint exchange
Client receives ID token and usually an access token.
Client validates the ID token
Signature and claims (iss, aud, exp, nonce) are verified before creating a local session.
App session begins
The relying party establishes its own session cookie or token strategy for subsequent requests.
Important OIDC artifacts
ID token
JWT asserting identity to the client; validate before trust.
openid scope
Required scope that signals an OIDC authentication request.
UserInfo endpoint
Optional endpoint for additional profile claims using an access token.
Discovery document
Metadata URL advertising endpoints and key material for interoperable clients.
Security checklist
- Request scope openid and validate ID tokens on the client before creating sessions.
- Enforce exact redirect URIs and PKCE for public clients.
- Bind login with nonce and state to prevent replay/CSRF issues.
- Do not use ID tokens as API access tokens unless explicitly designed and validated for that.
- Apply MFA policies at the OpenID Provider for privileged applications.
- Rotate signing keys via JWKS and cache carefully with kid handling.
- Log authentication events without writing raw tokens to logs.
- Review OIDC clients for the same misconfigurations that plague OAuth.
The practical takeaway
OpenID Connect (OIDC) standardizes authentication on top of OAuth 2.0 using ID tokens and interoperable identity claims. It is the common modern choice for app login and SSO against an identity provider.
Treat ID token validation as mandatory authentication code, keep OAuth redirect/PKCE hygiene tight, and separate identity tokens from API access tokens unless your design explicitly requires otherwise.
Related security terms
OAuth 2.0
The authorization framework OIDC extends with authentication semantics.
Single Sign-On (SSO)
Broader SSO architectures frequently implemented with OIDC.
JWT (JSON Web Token)
ID tokens are JWTs that assert authenticated user identity.
SAML (Security Assertion Markup Language)
An alternative federated identity protocol still widely used in enterprises.
OAuth Misconfiguration
Many OIDC failures are OAuth configuration failures with identity impact.
Frequently asked questions
What is OpenID Connect in simple terms?
OIDC is a standard way for apps to log users in using an identity provider. After you sign in at the provider, the app receives an ID token that proves who you are.
How is OIDC different from OAuth 2.0?
OAuth 2.0 focuses on delegated authorization to APIs. OIDC adds authentication: standardized ID tokens and user identity claims on top of OAuth flows.
What is an ID token?
An ID token is a JWT issued by the OpenID provider that asserts the user’s authenticated identity to the client, including claims such as issuer, subject, audience, and authentication time.
What is an OpenID Provider?
The OpenID Provider (OP) is the authorization server that authenticates users and issues ID tokens (and often access tokens) to relying party clients.
Can OIDC be used for SSO?
Yes. Many modern SSO deployments use OIDC so multiple applications rely on one identity provider for login.
Should APIs accept ID tokens as access tokens?
Generally no. Access tokens authorize API access; ID tokens authenticate the user to the client. Use the correct token for each purpose.
What validations are required for ID tokens?
Verify signature, issuer, audience, expiry, and nonce/state bindings as applicable. Reject tokens meant for other clients.
References
Explore authoritative guidance and frameworks related to openid connect (oidc).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.