OpenID Connect ID token
An OpenID Connect ID token is a signed token containing claims about an authenticated end user, the authentication event, and the client for which it was issued.
Software Security for Developers
An ID token is an OpenID Connect JWT containing claims about the authenticated end user and the authentication event.
- How it is used
- Authenticates users by carrying standardized identity claims alongside an access token in an OIDC flow.
- How deep it goes
- Explains the token’s purpose, JWT requirement, claims, and contrast with access tokens, without detailing claim-validation procedures.
- Examples
- Uses an authorization-code token response containing access_token, id_token, scope, token_type, and expires_in.
- What you can do after
- Evaluate whether a token should authenticate a user or authorize resource access, and identify where extra profile data comes from.
Read how Software Security for Developers explains OpenID Connect ID token →
ASP.NET Core in Action, 3e
An ID token is an OpenID Connect token that describes a user authentication event and may contain claims about the authenticated user.
- How it is used
- Describes an OpenID Connect authentication event and authenticated-user claims rather than authorizing resource access.
- How deep it goes
- Defines the token’s purpose and contrasts it with access tokens, without detailing its complete validation or issuance flow.
- Examples
- Uses a decoded JWT example to show header, payload, signature, and the need for signature verification.
- What you can do after
- Evaluate whether a token communicates authentication or authorizes access to a resource.
Read how ASP.NET Core in Action, 3e explains OpenID Connect ID token →
Secure APIs
An ID token is a token issued by an identity provider that conveys claims about an authenticated user or authentication event to a client.
- How it is used
- Establishes a user’s identity after an OpenID Connect authentication flow, while leaving API authorization to access tokens.
- How deep it goes
- Defines claims, distinguishes token roles, and sketches the OIDC flow without detailing token validation internals.
- Examples
- Uses Gmail or GitHub sign-in and an identity-provider redirect returning ID and optional access tokens.
- What you can do after
- Evaluate identity and authorization designs by keeping user identification in ID tokens and API permissions in access tokens.
Related concepts
- JSON Web Tokenkind of · A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
- openid connectproduced by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
- API keycontrasts with · An API key is a credential used to identify or authorize a client accessing an application programming interface.
- tokenkind of · A token is a discrete unit of text, such as a word, word fragment, character, or symbol, represented and processed as an element by a language model.
- bearer authenticationkind of · Bearer authentication is an authentication scheme in which presenting a bearer token is sufficient to use the access or authorization granted by that token.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.