OpenID Connect

OpenID Connect (OIDC) adds authentication to OAuth 2.0. Alongside the access token, the authorization server issues an ID token — a JWT whose claims identify the user (subject, issuer, audience, issue and expiry time) and that the client can verify with the provider's public keys. "Sign in with Google" and most enterprise single sign-on are OIDC.

How it works

A client discovers a provider's endpoints and capabilities from its discovery document at /.well-known/openid-configuration, requests the openid scope in an authorization code flow, receives an ID token, and validates its signature against the keys published at the provider's JWKS URL. It must also check the issuer, the audience and the expiry.

The misconception

That decoding the ID token is the same as validating it. Anyone can decode a JWT; trusting its claims requires checking the signature with the right key and confirming it was issued by the expected provider, for this client, and has not expired.

Try it here

The Modern Identity API serves a discovery document on GET /identity/v1/.well-known/openid-configuration and a key set on GET /identity/v1/jwks; the JWT decoder in the tools section shows what a token carries.

Sources

Other terms

JWT (JSON Web Token) — A compact format for claims, represented as a signed JWS or encrypted JWE.
JWKS — A JSON Web Key Set — the public keys an issuer publishes so that anyone can verify the tokens it signs.
Bearer token — A credential where possession alone grants access — whoever holds it can use it.
Refresh token — A long-lived credential used only to obtain new short-lived access tokens, without asking the user to log in again.
OAuth 2.0 — The standard framework for letting an application get a limited access token, instead of handling the user's password.
PKCE — Proof Key for Code Exchange — a one-time secret that stops a stolen OAuth authorization code from being redeemed by anyone else.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 16 October 2026