API Fundamentals Course
API Fundamentals
/
Advanced

OpenID Connect

Definition

An identity layer built directly on top of the OAuth 2.0 protocol. While OAuth handles Authorization (permissions), OpenID Connect handles Authentication (identity).

Explain Like I'm New

OAuth 2.0 was designed to say: 'Give this app access to my photos.' Developers started hacking it to say: 'Give this app my profile picture so I can log in.' OpenID Connect formalized this. It is OAuth 2.0, plus a specific 'ID Token' (a JWT) that contains the user's name, email, and profile picture.

Real World Example

Almost every modern 'Sign in with Google/Apple/Microsoft' button uses OpenID Connect (OIDC). It standardizes the identity data so your app always gets a predictable JWT containing the user's email.

Common Use Cases

  • •Social Login
  • •Enterprise Identity Providers (Okta, Auth0)

Interactive Example

Loading...
Console output will appear here...

Interview Questions

basic

  • What specific type of token does OpenID Connect introduce that standard OAuth 2.0 does not have?

intermediate

  • Why did the industry need to build OpenID Connect on top of OAuth?

Flash Cards

Question

Which token?

Click to reveal answer
Answer

The ID Token (which is always a JWT).

Question

Why build on top?

Click to reveal answer
Answer

Because OAuth only provides an opaque 'Access Token' meant for accessing APIs, not identifying humans. Developers had to manually use that access token to hit a custom `/me` endpoint just to get the user's email, and every company built their `/me` endpoint differently. OIDC standardized identity delivery.