OIDC
OpenID ConnectOIDC is the thin layer that turns OAuth into a login. It reuses OAuth’s flow exactly, but adds an ID token — a signed JWT stating who the user is, and a standard userinfo endpoint — so an app can verify an identity rather than merely hold a permission.
OIDC adds a signed ID token to OAuth — which is what makes “sign in with…” an authentication rather than a guess.
How it works
The ID token is for the app, about the user — which is why checking aud matters: a token minted for a different app must never be accepted as a login here.
What OIDC does, step by step
An ordinary OAuth authorisation request, plus scope=openid and a nonce for replay protection.
The token response includes a signed JWT describing the authentication that just happened.
Check the signature against the provider’s JWKS, then iss, aud, exp and the nonce you sent.
The userinfo endpoint returns profile claims that were too large or too fresh for the token.
In cybersecurity
An ID token is only as good as its validation — a library that decodes a JWT without checking the signature accepts whatever anyone chooses to send.
Against the provider’s JWKS, and never trust the alg header — reject “none” outright.
A valid token from the right provider for the wrong app is not a login for yours.
It binds the token to your request and stops an old one being replayed.
Email addresses change and can be reassigned; sub is the provider’s stable identifier.
Cache JWKS but honour kid, or a routine key rotation logs everyone out.
It authenticates the user to the app; the access token is what calls the API.