A relying party requests the openid scope from an OpenID Provider, which authenticates the end user and returns an ID Token containing verifiable claims about the authentication event and subject. The protocol can also provide selected claims through a UserInfo endpoint.
In a common authorization-code flow, the relying party receives a code through the browser and exchanges it at the token endpoint. It must validate the ID Token’s signature, issuer, audience, expiry, and transaction-binding values such as nonce, as applicable. Provider discovery and registration can automate configuration, but only within a trust model that determines which issuers, endpoints, keys, and algorithms are acceptable.
Key points
Protocol rolesThe OpenID Provider performs authentication and issues claims; the relying party validates the response and creates its own application session.
Separate artifactsUse the ID Token to understand the authentication result and use an access token only for its intended protected resource; the tokens are not interchangeable.
Privacy and lifecycleRequest only necessary claims, use stable identifiers carefully, protect sessions, manage signing-key rollover, and define logout and account-change behavior explicitly.
Important limitationA valid ID Token proves only the claims and authentication context asserted by a trusted provider. It does not establish legal identity, current application authorization, or the safety of the resulting local session.