Comparisons

OAuth 2.0 or OpenID Connect: what is the difference?

OAuth 2.0 is for authorising, OpenID Connect for authenticating. OIDC is a layer added on top of OAuth 2.0.

In short

OAuth 2.0 answers “is this application allowed to access this resource?” and issues an access token. OpenID Connect answers “who is signed in?” and adds an identity token (ID token) and the scope openid.

	OAuth 2.0	OpenID Connect
Question	What are we allowed to do?	Who is signed in?
Main token	Access token (opaque or JWT)	ID token (signed JWT)
Token recipient	L'API (ressource)	L'application (client)
Key scope	Specific to the API (read, write…)	`openid`, `profile`, `email`
Information about the person	Not standardised	Claims standard, endpoint userinfo
Classic mistake	Using an access token to identify someone	Forgetting to check `nonce`, audience and signature

Key takeaways

Signing in to an application: use OIDC.
Calling an API on someone's behalf: use an OAuth 2.0 access token.
An access token does not prove identity: do not use it to sign someone in.

Test OpenID Connect Decode a JWT SAML or OIDC?