OpenID Connect (OIDC)

OpenID Connect is the identity layer on OAuth 2.0, providing the signed ID token behind "Log in with ..." buttons and enterprise SSO logins.

OpenID Connect is the identity layer on top of OAuth 2.0, standardised by the OpenID Foundation. A client that requests the mandatory openid scope always receives a signed ID token (a JSON Web Token, or JWT) stating who authenticated, when, how, and at which identity provider; an access token for calling APIs may or may not be issued alongside it. Additional profile claims such as name or e-mail address are typically retrieved from the provider's UserInfo endpoint using that access token. Providers publish discovery metadata (a well-known configuration document) so clients can find endpoints and keys automatically. OIDC is the protocol behind most modern "Log in with ..." buttons and enterprise SSO. It should not be confused with the older, now largely abandoned OpenID 2.0 protocol, which it replaced.

Depending on the scheme or profile, OIDC's acr/amr claims can be used to convey the assurance level and authentication method, which is how high-assurance eID logins express their strength. Its lineage continues into the wallet world: OpenID4VC reuses the same foundations for issuing and presenting credentials.