OpenID Connect is an identity layer built on top of OAuth 2.0 that adds a standard way for an application to confirm who authenticated and to receive basic profile information as a signed token. Where OAuth 2.0 answers "what can this app access," OIDC answers "who logged in."
Frequently asked questions
Can you use OIDC without OAuth 2.0?
No, OIDC is explicitly built as an identity layer on top of OAuth 2.0, not a standalone protocol.
What does an OIDC token actually contain?
Identity claims like name, email, and subject identifier, distinct from the access token that grants API access.
Is OIDC the same as SAML?
They solve a similar problem (federated authentication) but OIDC is newer, lighter weight, and generally preferred for modern web and mobile apps, while SAML remains common in enterprise SSO. See single sign-on.
.avif)