OpenID Connect (OIDC)
Definition
OpenID Connect extends OAuth 2.0 with verifiable identity information.
An identity layer on OAuth 2.0 that allows a client to verify an end user's authentication by an OpenID Provider and receive standardized identity claims.
Simply explained
An application can verify who logged in via a recognized login service.
Why it matters in practice
Helps develop and operate digital systems robustly, securely, and maintainably.
Example from business
A web application logs users in via a corporate identity provider and verifies ID tokens and nonce.
Limits and pitfalls
- Equating OIDC with authorization, using ID tokens as access tokens, or not verifying signature, issuer, audience, expiration, and possibly nonce.
Origin & history
OpenID Connect Core 1.0 was finalized in 2014.
Use in mid-sized companies
- Possible application: A web application logs users in via a corporate identity provider and verifies ID tokens and nonce.
Frequently asked questions
What does OpenID Connect mean?
An identity layer on OAuth 2.0 that allows a client to verify an end user's authentication by an OpenID Provider and receive standardized identity claims.
Which mistakes should be avoided?
Equating OIDC with authorization, using ID tokens as access tokens, or not verifying signature, issuer, audience, expiration, and possibly nonce.
Sources
Source checked on 10.10.2026. Editorial application examples are hypothetical; no proof of real customer results.
Editorially reviewed on: