OpenID Connect (OIDC)

In short: OpenID Connect is a layer on top of OAuth that answers: who is the user? OAuth only governs access to data; OIDC adds sign-in.

The problem

With “Sign in with Google” your site should learn who is signing in without ever seeing a password. OAuth alone gives only an access token, not a verified identity.

What OIDC adds

• The ID token: a JWT with claims such as sub (stable user ID), iss (issuer), aud (audience), exp (expiry) and often email and name.
• The provider signs it (Digital signature); the site verifies the signature with the provider’s public key.
• Standard scopes (openid, profile, email) and a userinfo endpoint for more data.

Flow (code flow with PKCE)

1. The site redirects to the provider with scope=openid, a random state and a PKCE check value.
2. The user signs in there (ideally with MFA or Passkeys).
3. The provider sends back a code.
4. The server exchanges the code for ID and access tokens.
5. The server checks signature, iss, aud, exp and nonce and creates the session.

Typical mistakes

• Verifying tokens in the browser instead of on the server.
• Not checking aud or iss.
• Matching users by email instead of sub (emails can change).
• Omitting state (CSRF risk).

Further reading: SSO.