An ID token is an OpenID Connect JWT containing claims about the authenticated end user and the authentication event. It answers “Who is the user?” while an access token answers “What can they access?” section 13.3.1 section 13.5
Keep the two token roles separate:
- Use the access token for authorization when accessing protected resources. section 12.5
- Use the ID token to identify and authenticate the user who signed in. section 13.3.1
- Expect the ID token only with OIDC, because standard OAuth 2.0 does not define it. section 13.3.1
- Read identity claims such as the user ID, email, name, and other profile information from its JWT payload. section 13.3.1
Authorization-code response
After the client sends the authorization code to the token endpoint, an OIDC response can contain both an access_token and an id_token, along with the openid scope. The access token supports resource authorization; the ID token carries the authenticated user’s identity. section 12.3
OIDC also complements the ID token with the UserInfo endpoint for additional profile data. Nonce and state help protect OIDC flows against replay and CSRF attacks, while session management and logout standardize the surrounding sign-in experience. section 13.3 section 13.6
