OAuth vs OIDC: what is the difference?
Practice this questionWANT TO UNDERSTAND THE CONCEPT FIRST?Learn OAuth vs OIDC: what is the difference?
Definition:
OAuth is a framework for delegated access, allowing a client to act with limited permission on protected resources. OpenID Connect (OIDC) adds a standard identity layer for user login on top of OAuth. The authorization code flow separates browser redirects from the token exchange and commonly uses PKCE to protect that exchange.
Key points:
-
OAuth allows an app to access resources with permission.
-
OIDC adds identity information for login on top of OAuth.
-
ID tokens identify the login user; access tokens are for the intended API.
-
Request only needed scopes and validate the intended issuer and audience rather than trusting any correctly signed token.
Interview point:
- Use an ID token to establish the client's login identity and an access token intended for the resource API to call that API.
Adapted from 02_NODE_EXPRESS_HTTP.md · “OAuth vs OIDC: what is the difference?”. Code examples are study fragments. Difficulty and core labels are editorial estimates; version-specific behavior should be checked against your project.