OpenID Connect

OpenID Connect (OIDC) is an authentication protocol built on top of OAuth 2.0. It allows clients (like web or mobile apps) to verify the identity of a user who logs in via an external identity provider (IdP) — such as Google, Microsoft, Apple, etc.

🔐 In Short:

OAuth 2.0 → handles authorization (access to resources)
OpenID Connect → handles authentication (who is the user?)

🧱 How Does OpenID Connect Work?

User clicks "Login with Google"
Your app redirects the user to Google’s login page
After successful login, Google redirects back with an ID token
Your app validates this JWT token
You now know who the user is — verified by Google

🔑 What’s Inside the ID Token?

The ID token is a JSON Web Token (JWT) containing user identity data, like:

{
  "iss": "https://accounts.google.com",
  "sub": "1234567890",
  "name": "John Doe",
  "email": "john@example.com",
  "iat": 1650000000,
  "exp": 1650003600
}

iss = issuer (e.g. Google)
sub = user ID
email, name = user info
iat, exp = issued at / expiration

🧩 Typical Use Cases

“Login with Google/Microsoft/Apple”
Single Sign-On (SSO) in organizations
Centralized user identity (Keycloak, Auth0, Azure AD)
OAuth APIs that require identity verification

🛠️ Core Components

Component	Description
Relying Party	Your app (requests login)
Identity Provider	External login provider (e.g. Google)
ID Token	JWT containing the user’s identity
UserInfo Endpoint	(Optional) endpoint for additional user data