What is OpenID Connect?
Also known as: OIDC
OpenID Connect (OIDC) is an identity authentication layer built on OAuth 2.0 that provides a signed ID token containing verified user identity claims.
OpenID Connect (OIDC) is an identity authentication protocol that extends OAuth 2.0 with a standardized mechanism for verifying the identity of an end user. It was developed by the OpenID Foundation and published as a set of specifications in February 2014. OIDC adds a signed JSON Web Token (JWT) called an ID token, which contains claims about the authenticated user such as their name, email address, and a unique subject identifier.
When a client application wants to authenticate a user, it initiates an OIDC flow by redirecting the user to an OpenID Provider (OP). The OP authenticates the user and returns an authorization code to the client. The client exchanges this code for an ID token and an access token from the OP's token endpoint. The client validates the ID token's signature using the OP's public keys (fetched from a JWKS URI) and checks the token's issuer, audience, and expiration. The access token can then be used to retrieve additional user information from the UserInfo endpoint.
OIDC sits on top of OAuth 2.0, reusing its authorization framework, token endpoints, and client registration. While OAuth 2.0 alone provides delegated authorization (what the user allows the client to do), OIDC adds authentication (who the user is). OIDC supports multiple flows: the authorization code flow for server-side applications, the implicit flow for browser-based apps (now discouraged), and the hybrid flow. It also defines discovery (via a well-known configuration endpoint) and dynamic client registration, making it the dominant identity protocol for modern web and mobile applications.
Key facts
- Built on OAuth 2.0, adding an ID token for user authentication.
- ID token is a signed JWT containing claims like sub, name, and email.
- Supports authorization code, implicit, and hybrid flows.
- Defined by the OpenID Foundation in 2014, with core spec at OpenID.Core.
- Provides a UserInfo endpoint to fetch additional identity claims.
How it works in practice
Related terms
References
More in Security
2FA
Two-factor authentication (2FA) is a security method that requires a user to present two distinct types of evidence to verify their identity, typically a password and a time-based one-time code from an authenticator app or hardware key.
Bot Management
Bot management detects automated web traffic and distinguishes it from human users, using behavioral fingerprinting and other signals to block malicious bots while allowing benign ones.
Credential Stuffing
Credential stuffing is a cyberattack in which automated tools use username-password pairs leaked from one site to try logging into other sites, exploiting password reuse.
DDoS
A DDoS (Distributed Denial of Service) attack overwhelms a target server, service, or network with massive traffic from many compromised computers, making it unavailable to legitimate users.
DDoS Scrubbing
DDoS scrubbing diverts attack traffic to a specialized filtering facility that removes malicious packets and forwards only legitimate traffic to the target network.
Firewall
A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.
IDS
An Intrusion Detection System (IDS) monitors network traffic or host activity for signs of malicious behavior or policy violations and generates alerts for security personnel.
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic inline and actively blocks malicious packets before they reach their target.
OAuth 2.0
OAuth 2.0 is an authorization framework that allows a user to grant a third-party application limited access to their resources on another service without revealing their password.
Passkey
A passkey is a FIDO2/WebAuthn credential stored on a user's device that replaces passwords with public-key cryptography for authentication.