Glossary

ID token

A JWT that an OpenID Connect provider issues to the client to say who signed in, when and how (OpenID Connect Core 1.0). The client must validate its signature, issuer, audience (its own client ID), expiry and nonce, and must not send it to APIs as an access token.

Defined in: OpenID Connect Core 1.0: ID Token

Covered in

Guide

OAuth 2.0 and OpenID Connect login: authorization code with PKCE

Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.

Practice: OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE