OpenID Connect

OpenID Connect 1.0 identity layer on top of OAuth 2.0

Start with Recommended FlowRecommended Flow Open Looking Glass

Available Flows

OIDC Authorization Code Flow

OpenID Connect 1.0 authentication using the OAuth 2.0 Authorization Code flow (OIDC Core §3.1). Adds an ID Token containing identity claims about the authenticated user. Most secure flow for server-side applications.

ID Token (JWT)UserInfo EndpointVerified Identity

View flow diagram

OIDC Implicit Flow (Legacy)

OpenID Connect Implicit flow returns tokens directly from the authorization endpoint (OIDC Core §3.2). ⚠️ DEPRECATED: Not recommended for new applications due to token exposure in browser history and URL. Use Authorization Code + PKCE instead.

Legacy FlowDirect Token ResponseNot Recommended

View flow diagram

OIDC Hybrid Flow

Combines Authorization Code and Implicit flows (OIDC Core §3.3). Returns ID Token immediately for fast identity verification while authorization code is exchanged securely server-side. Useful when client needs identity before backend token exchange completes.

View flow diagram

UserInfo Endpoint

Protected resource that returns claims about the authenticated End-User (OIDC Core §5.3). Access requires a valid access token with 'openid' scope. Returns claims based on granted scopes (profile, email, address, phone).

View flow diagram

OpenID Connect Discovery

Auto-configuration mechanism that allows Relying Parties to discover the OpenID Provider's endpoints, supported features, and cryptographic capabilities (OIDC Discovery §4). Essential for dynamic client registration and multi-provider support.

View flow diagram

Specs & references

Authoritative reading list for OpenID Connect — core specs, security considerations, and companion standards.

Core specs

· The specifications that define this protocol.

Security & privacy

· Dedicated security and privacy considerations.

OpenID Connect Core §16 — Security Considerations
Section dedicated to OIDC-specific threats above OAuth 2.0.

Companion specs

· Extensions, hardenings, and supporting RFCs.

Deployment profiles

· Profiles that constrain the protocol for specific assurance regimes.

OpenID Connect Features

ID Token (JWT)

JWT containing verified identity claims (sub, name, email)

UserInfo Endpoint

API endpoint returning additional user claims

Discovery Document

Auto-configuration via /.well-known/openid-configuration