OpenID Connect is an identity protocol that lets an application verify who a user is after they sign in. It builds on OAuth 2.0, which governs delegated access to APIs, by adding standardized authentication and an ID token. It supports secure single sign-on across web and mobile applications.
OpenID Connect
What is OpenID Connect?
OpenID Connect, or OIDC, is an identity protocol that lets an application verify who a user is after sign-in. Built on OAuth 2.0, it supports secure single sign-on for web and mobile apps.
How OpenID Connect works
Most apps use Authorization Code with PKCE.
- The relying party, or app, redirects the user to an OpenID Provider.
- The provider authenticates the user and returns a short-lived code.
- The app exchanges the code for tokens.
- The app validates the signed ID token, including its issuer, audience, expiry, nonce, and claims. Discovery metadata publishes the provider’s endpoints and keys.
OpenID Connect vs OAuth 2.0
OAuth grants access. OIDC establishes identity.
| OpenID Connect | OAuth 2.0 |
|---|---|
| Authentication | Authorization |
| ID token for the app | Access token for an API |
An access token alone is not proof of a user’s identity because its intended audience may be an API, not the app.
Benefits of OpenID Connect
OIDC creates a consistent sign-in experience.
- Supports single sign-on and fewer passwords.
- Uses portable profile claims and common web and mobile patterns.
Practical limits and security requirements
Correct configuration matters as much as the protocol.
- Allowlist exact redirect URIs, use PKCE, and verify state and nonce.
- Validate token signatures and claims, use short lifetimes, and never use an ID token to call an API.
OpenID Connect and SAML
Both enable federated sign-in, but they suit different environments.
| OIDC | SAML |
|---|---|
| JSON and JWT-based | XML-based assertions |
| Usually preferred for modern mobile and API-connected apps | Often retained for established enterprise integrations |
Using OpenID Connect in an Emergent app
When building an app with Emergent, configure provider callback URLs and secrets outside source code, then test authenticated journeys. See Connect Your Tools and app design and development for related guidance.
Frequently Asked Questions
Your Questions, Answered
This will automatically populate, don't change
Don't change this element unless you know what you are doing
What are the key differences between OAuth 2.0 and OpenID Connect?
OAuth 2.0 delegates access to resources. OIDC adds standardized authentication, an ID token, user claims, and identity-focused endpoints.
Can you provide an example of how to use OpenID Connect?
A project-management app redirects a user to Microsoft or Google sign-in, receives an authorization code, exchanges it securely, validates the ID token, and creates a session.
Why is it a bad idea to use OAuth 2.0 for authentication?
OAuth access tokens are designed for APIs. Without OIDC validation rules, an app can misinterpret a token that was issued for a different audience or purpose.
Why use OIDC instead of SAML?
OIDC is generally simpler for modern web and mobile apps because it uses JSON-based tokens and works naturally with API-driven architectures. SAML may still be required by an existing enterprise identity provider.
Is OIDC deprecated?
No. OIDC is an active, widely implemented identity standard maintained by the OpenID Foundation.
Start Building
on Emergent today
on Emergent today
Start Building
