OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds authentication, enabling applications to verify a user’s identity and obtain basic profile information via a trusted identity provider. Where OAuth handles authorization (access to resources), OIDC handles authentication (proving who the user is), which is what makes secure "sign in with" and single sign-on possible.

OIDC exists because developers kept (incorrectly and insecurely) using OAuth 2.0 for login. OIDC standardizes that use case properly, layering identity on OAuth’s solid authorization foundation.

How OIDC works

OIDC uses OAuth 2.0 flows but adds a key element: the ID token, a signed JWT that asserts the user’s identity and includes claims about them (a unique identifier, and optionally name, email, etc.). When a user signs in via OIDC, the identity provider authenticates them and returns an ID token to the application, which validates the token’s signature and reads the claims to establish who the user is. A UserInfo endpoint can provide additional profile data. Because the ID token is signed by the trusted provider, the app can trust the identity assertion.

OIDC vs. OAuth 2.0

The relationship is layered, not competing. OAuth 2.0 is authorization (delegated access to resources); OIDC is authentication (verifying identity) built on top of it. OAuth issues access tokens for resources; OIDC adds the ID token for identity. If you need to let an app access a resource, OAuth suffices; if you need to log a user in and know who they are, you need OIDC. Using raw OAuth for authentication is a known anti-pattern precisely because it lacks the identity assertions OIDC provides.

Why OIDC matters

OIDC is the modern standard for federated authentication and SSO on the web and mobile. It powers social login ("sign in with"), enterprise SSO, and any scenario where an application delegates authentication to a trusted identity provider. Its standardization means interoperability (apps and identity providers that speak OIDC work together) and its foundation on OAuth means it inherits a well-understood, widely-supported security model. For customer identity, OIDC is typically how a CIAM platform (acting as the identity provider) authenticates users across a company’s applications.

Security best practices

As with OAuth, correct implementation matters: validate ID token signatures and claims (issuer, audience, expiry, nonce), use the authorization code flow with PKCE, protect tokens in transit and at rest, and rely on well-maintained libraries rather than hand-rolling token validation. Pairing OIDC with strong, phishing-resistant authentication at the identity provider (passkeys) ensures the identity it asserts is trustworthy in the first place.

Frequently asked questions

What is OpenID Connect?

An identity layer on top of OAuth 2.0 that adds authentication, enabling apps to verify a user’s identity via a trusted provider.

What’s the difference between OIDC and OAuth 2.0?

OAuth is authorization (resource access); OIDC adds authentication (identity) via a signed ID token on top of OAuth.

What is an ID token?

A signed JWT issued by the identity provider that asserts the user’s identity and includes claims about them.

What is OIDC used for?

Federated authentication, single sign-on, and "sign in with", delegating login to a trusted identity provider.

Is OIDC better than SAML?

For modern web, mobile, and consumer use, OIDC is lighter and preferred; SAML remains dominant in enterprise SSO, so many platforms support both.

Related: OAuth 2.0 · OIDC vs. OAuth 2.0 · Single Sign-On (SSO) · Identity Provider (IdP) · Identity Federation · Token-Based Authorization (JWT)