# OpenID Connect (OIDC)

Source: https://startwithidentity.com/standards/openid-connect/
Last updated: 2026-06-16
License: content by Start with Identity. Cite the source URL.

---

## What it is

OpenID Connect (OIDC) is a thin identity layer built on top of [OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/). Where OAuth gives an app delegated access, OIDC adds standardized authentication: it tells the app that a user logged in and who they are. It is the modern foundation for single sign-on across consumer apps, mobile, and APIs.

## How it works

OIDC introduces the **ID token**, a signed [JWT](https://startwithidentity.com/glossary/jwt/) containing [claims](https://startwithidentity.com/glossary/claims/) about the authenticated user (subject identifier, name, email, authentication time). The app validates the token's signature against the provider's published keys ([JWKS](https://startwithidentity.com/glossary/jwks/)) and reads the claims. A standard userinfo endpoint returns additional profile data.

- **ID token:** proof of authentication, as a JWT.
- **Access token:** still OAuth, for calling APIs.
- **Discovery:** providers publish configuration at a well-known URL so clients can self-configure.

## Status

OIDC Core 1.0 is final and ubiquitous, supported by every major identity provider. It was republished as ITU-T Recommendation X.1285 in 2025. Extensions like the Shared Signals Framework and [CIBA](https://startwithidentity.com/glossary/ciba/) continue to evolve.

## When to use it

Any time you need to log a user in. Reach for OIDC over raw OAuth for authentication, and over [SAML](https://startwithidentity.com/standards/saml-2-0/) when building modern web, mobile, or API-centric apps.

## Pitfalls

- Always validate the ID token signature, issuer, audience, and expiry.
- Do not confuse the ID token (authentication) with the access token (authorization).

## Related

Guides: [OAuth vs OIDC](https://startwithidentity.com/guides/fundamentals/oauth-vs-oidc/), [SAML vs OIDC](https://startwithidentity.com/guides/fundamentals/saml-vs-oidc/). Glossary: [OIDC](https://startwithidentity.com/glossary/oidc/), [ID token](https://startwithidentity.com/glossary/id-token/).

## Who wrote it

OpenID Connect was authored by a group including [Nat Sakimura](https://startwithidentity.com/experts/nat-sakimura/), [Mike Jones](https://startwithidentity.com/experts/mike-jones/), and [John Bradley](https://startwithidentity.com/experts/john-bradley/). [Vittorio Bertocci](https://startwithidentity.com/experts/vittorio-bertocci/) did much of the work of explaining it to developers, and [Filip Skokan](https://startwithidentity.com/experts/filip-skokan/) and [Roland Hedberg](https://startwithidentity.com/experts/roland-hedberg/) maintain certified implementations. More in the [experts directory](https://startwithidentity.com/experts/).