01.05 · Concept
OAuth & OpenID Connect
Say what OAuth delegates and what OIDC adds on top of it, and name the flow RFC 9700 tells you to use and the two it tells you to stop using.
OAuth delegates limited access to an API without sharing the user’s password; OpenID Connect adds a standard way for the client to learn who signed in. Modern browser apps should use the authorization code flow with PKCE, not the implicit flow or resource owner password credentials flow.
What this lesson answers
- what does OAuth delegate in an application
- how does OpenID Connect differ from OAuth
- which OAuth flows should modern apps avoid
Notes
OAuth is about delegated authorization: letting one application act with limited permission against another service without giving it your password. The classic mental model is valet parking: you do not hand over ownership of the car, only a constrained key that lets the valet do a specific job. In software, that constrained key is usually an access token, issued by an authorization server and accepted by an API or resource server.
OpenID Connect adds login identity on top of OAuth. OAuth can tell an API that a client is allowed to read your calendar; OIDC can tell the client who the signed-in…
Common questions
- Is OAuth the same thing as login?
- No. OAuth is for delegated authorisation: a client gets permission to call an API on a user’s behalf. It does not, by itself, define how the client proves who the user is. OpenID Connect adds that identity layer, including an ID token intended for the client.
- What is the difference between an access token and an ID token?
- An access token is presented to an API to authorise a request. An ID token is consumed by the client application and carries claims about the authenticated user and the authentication event. Confusing the two often leads to broken trust boundaries in application auth design.
- Which OAuth flow should a browser app use now?
- Use the authorization code flow with PKCE. The app sends the user to the identity provider, receives a code, then redeems it while proving it initiated the request. RFC 9700 says to stop using the implicit flow and resource owner password credentials flow.