OpenID Connect
An identity layer on top of OAuth 2.0 that provides authentication and user profile information via ID tokens.
What is OpenID Connect?
OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 framework. While OAuth 2.0 is designed for authorization (granting access to resources), OpenID Connect adds authentication (verifying who the user is).
OIDC introduces the ID Token - a JWT (JSON Web Token) that contains authenticated user information (subject ID, name, email, etc.). This allows clients to:
- Verify the user's identity
- Obtain basic profile information
- Maintain a session with the identity provider
OIDC is widely used for Single Sign-On (SSO) in consumer and enterprise applications, supported by Google, Microsoft, Apple, and many other identity providers.
Analogy
Think of OpenID Connect like a VIP badge that not only gets you into the club (OAuth access token) but also shows your photo ID and name (ID token with user info). It proves who you are, not just that you're allowed in.
Types and Use Cases
- Consumer SSO: "Sign in with Google" uses OIDC to authenticate users and get their profile info
- Enterprise SSO: Azure AD, Okta, and Ping Identity use OIDC for employee authentication
- Mobile Apps: Use OIDC authorization code flow with PKCE for secure mobile authentication
- API Security: Use ID tokens to verify user identity when making API calls
How it Works
// OpenID Connect ID Token (JWT)
{
"iss": "https://accounts.google.com",
"sub": "108123456789012345678",
"aud": "1234567890.apps.googleusercontent.com",
"exp": 1678900000,
"iat": 1678896400,
"name": "John Doe",
"email": "john.doe@gmail.com",
"picture": "https://lh3.googleusercontent.com/..."
}
// Authorization Request
GET /oauth2/v2/auth?
client_id=1234567890&
response_type=code&
scope=openid%20profile%20email&
redirect_uri=https://app.example.com/callback&
nonce=abc123OpenID Connect vs OAuth 2.0
OpenID Connect
OAuth 2.0
OpenID Connect provides authentication + user info (ID token)
OAuth 2.0 provides only authorization (access token)
OIDC is built on top of OAuth 2.0 - it extends OAuth with identity features
Use OIDC when you need to know who the user is
Use OAuth when you only need access to their resources
Best Practices for OpenID Connect
- Always validate ID token: Verify signature, issuer, audience, and expiration before trusting the token
- Use nonce and state: Prevent replay attacks and CSRF by including unique nonce and state parameters
- Request minimal scopes: Only request 'openid profile email' - avoid over-scoping permissions
How LoginRadius Powers OpenID Connect
LoginRadius CIAM platform provides comprehensive OpenID Connect support. As an OIDC Provider, LoginRadius issues ID tokens for your custom applications to verify user identity. As an OIDC Client, LoginRadius connects to 40+ social providers (Google, Microsoft, Apple) via OIDC for social login. Our platform handles the complete OIDC flow, normalizes user profile data across providers, and provides SDKs for easy integration. LoginRadius also supports OIDC for enterprise SSO connections (Azure AD, Okta, Ping).
FAQs
No. OAuth 2.0 is an authorization framework - it allows apps to access resources on behalf of a user (like accessing Google Drive files). OpenID Connect is an identity layer on top of OAuth 2.0 - it allows apps to verify the user's identity and get their profile info. Think of OAuth as 'access delegation' and OIDC as 'identity verification with access delegation'.
The ID Token is a JWT (JSON Web Token) that contains authenticated user information. It includes: iss (issuer), sub (user ID), aud (client ID), exp (expiration), name, email, and other claims. The ID token is signed by the provider (Google, Microsoft, etc.) so the client can verify its authenticity. Unlike access tokens (opaque), ID tokens are self-contained and can be decoded by the client.
LoginRadius acts as both an OIDC Provider (for your applications) and an OIDC Client (connecting to Google, Microsoft, etc.). As a provider, LoginRadius issues ID tokens that your apps can use to verify user identity. As a client, LoginRadius connects to social providers (Google, Apple, Microsoft) via OIDC for social login. Our platform handles the complete OIDC flow: authorization, token exchange, ID token validation, and user profile normalization.