--- title: "OpenID Connect — Identity Glossary | IDSync" description: "OpenID Connect (OIDC) is a thin identity layer on top of OAuth 2.0 that lets a relying party verify a user's identity and obtain basic profile information…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "OpenID Connect", "item": "https://idsync.com/glossary/openid-connect" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/openid-connect", "name": "OpenID Connect", "alternateName": [ "OIDC", "OIDC", "OpenID Connect 1.0" ], "description": "OpenID Connect (OIDC) is a thin identity layer on top of OAuth 2.0 that lets a relying party verify a user's identity and obtain basic profile information via a signed JSON Web Token (ID token).", "url": "https://idsync.com/glossary/openid-connect", "inDefinedTermSet": "https://idsync.com/glossary" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is OIDC the same as OAuth?", "acceptedAnswer": { "@type": "Answer", "text": "No. OAuth 2.0 is an authorization framework. OIDC is an identity layer built on top of it. You can use OAuth without OIDC (for API access delegation), but you should not use OAuth alone for authentication." } }, { "@type": "Question", "name": "Do I need a refresh token?", "acceptedAnswer": { "@type": "Answer", "text": "For long-lived sessions in web apps, yes — store it server-side. For SPAs, prefer short-lived access tokens with silent re-authentication via the IdP session, or use the refresh token rotation pattern." } }, { "@type": "Question", "name": "What is PKCE?", "acceptedAnswer": { "@type": "Answer", "text": "Proof Key for Code Exchange. It binds the authorization request to the token exchange so an intercepted authorization code cannot be redeemed by an attacker. Required for public clients (SPAs, mobile) and recommended for all clients." } } ] } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. OpenID Connect Standards & Protocols # OpenID Connect (OIDC) OpenID Connect (OIDC) is a thin identity layer on top of OAuth 2.0 that lets a relying party verify a user's identity and obtain basic profile information via a signed JSON Web Token (ID token). Last reviewed 3 months ago Key points - OIDC adds 'who is the user' to OAuth 2.0's 'what can this client do.' - The core artifact is an ID token — a JWT signed by the IdP — alongside OAuth's access and refresh tokens. - Discovery via /.well-known/openid-configuration makes integrations dramatically easier than SAML. - The Authorization Code flow with PKCE is the recommended pattern for web, mobile, and SPAs. - OIDC is the default choice for new applications; SAML remains common in legacy enterprise. ## What is OpenID Connect? OpenID Connect (OIDC) is an identity protocol layered on top of [OAuth 2.0](/glossary/oauth-2). OAuth on its own answers "what is this client app allowed to do on the user's behalf?" — it deliberately says nothing about _who_ the user is. OIDC fixes that by adding an **ID token** that the identity provider signs and returns alongside OAuth's access token. OIDC is the protocol behind most "Sign in with Google / Apple / Microsoft" buttons, behind modern enterprise SSO into web and mobile apps, and behind [CIAM](/glossary/ciam) platforms like Auth0, Clerk, and FusionAuth. ## How OIDC works The recommended flow for almost every app today is the **Authorization Code flow with PKCE**: 1. Your app redirects the user to the IdP's `authorize` endpoint with `response_type=code`, a list of scopes (`openid email profile`), and a PKCE code challenge. 2. The IdP authenticates the user and asks for consent (for first-party apps this is usually invisible). 3. The IdP redirects back to your app's `redirect_uri` with a short-lived authorization code. 4. Your app's backend exchanges the code at the `token` endpoint for an **ID token**, an **access token**, and (optionally) a **refresh token**. 5. Your app verifies the ID token's signature using the IdP's public JWKS keys, checks `iss`, `aud`, `exp`, and `nonce`, and creates a local session. The ID token is a [JWT](/glossary/jwt) containing standard claims (`sub`, `email`, `name`, `auth_time`) and any custom claims the IdP is configured to issue. ## Why OIDC over SAML for new work - **Discovery.** `/.well-known/openid-configuration` exposes every endpoint and key — no manual XML metadata exchange. - **JSON, not XML.** JWTs are easy to parse, debug, and propagate across services. - **Mobile-native.** SAML was designed for browsers. OIDC works cleanly in native mobile apps via the system browser plus PKCE. - **Built on OAuth.** You get authorization (scopes, access tokens for APIs) and authentication in one protocol family. Use SAML when you must integrate with an older SP that doesn't support OIDC; otherwise prefer OIDC. ## Common pitfalls - **Treating the access token as an ID document.** The access token is opaque to your client and meant for APIs. Never make authentication decisions from its contents — use the ID token. - **Skipping signature verification.** "It came from the IdP redirect" is not verification. Always verify the JWT signature against the IdP's JWKS. - **Not validating `aud` and `iss`.** A token signed by your IdP for a different client is still cryptographically valid but not for you. - **Implicit flow.** The old implicit flow (`response_type=id_token token`) is deprecated. Use Authorization Code + PKCE. ## FAQ ### Is OIDC the same as OAuth? No. OAuth 2.0 is an authorization framework. OIDC is an identity layer built on top of it. You can use OAuth without OIDC (for API access delegation), but you should not use OAuth alone for authentication. ### Do I need a refresh token? For long-lived sessions in web apps, yes — store it server-side. For SPAs, prefer short-lived access tokens with silent re-authentication via the IdP session, or use the refresh token rotation pattern. ### What is PKCE? Proof Key for Code Exchange. It binds the authorization request to the token exchange so an intercepted authorization code cannot be redeemed by an attacker. Required for public clients (SPAs, mobile) and recommended for all clients. ## Standards & references - [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) - [OpenID Connect Discovery 1.0](https://openid.net/specs/openid-connect-discovery-1_0.html) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [sso](/directory/category/sso)[ciam](/directory/category/ciam)[iam platforms](/directory/category/iam-platforms) ### Related terms [oauth 2](/glossary/oauth-2)[single sign on](/glossary/single-sign-on)[saml](/glossary/saml)[jwt](/glossary/jwt)[pkce](/glossary/pkce) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the sso category. [Explore tools](/directory/category/sso) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.