🪪

OpenID Connect: Identity on Top of OAuth 2.0

Simple

Free preview · 2 of 5 steps

OIDC: OAuth 2.0 says 'what you can do', OIDC adds 'who you are'

OAuth 2.0 is an authorization protocol — it issues access tokens that say what resources an app can access on the user's behalf. But it says nothing about who the user is. OpenID Connect is a thin identity layer on top of OAuth 2.0: it adds an ID token (a signed JWT) that tells you who authenticated and when.

If you need login/signup (identity), use OIDC. If you only need API access delegation, use OAuth 2.0 alone.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step