# What is OpenID Connect (OIDC)?

> OpenID Connect (OIDC) is an authentication and identity-federation layer built on OAuth 2.0.

- Canonical URL: https://yellowcube.eu/glossary/openid-connect/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A relying party requests the `openid` scope from an OpenID Provider, which authenticates the end user and returns an ID Token containing verifiable claims about the authentication event and subject. The protocol can also provide selected claims through a UserInfo endpoint.

In a common authorization-code flow, the relying party receives a code through the browser and exchanges it at the token endpoint. It must validate the ID Token’s signature, issuer, audience, expiry, and transaction-binding values such as `nonce`, as applicable. Provider discovery and registration can automate configuration, but only within a trust model that determines which issuers, endpoints, keys, and algorithms are acceptable.

### Key points

- **Protocol roles:** The OpenID Provider performs authentication and issues claims; the relying party validates the response and creates its own application session.
- **Separate artifacts:** Use the ID Token to understand the authentication result and use an access token only for its intended protected resource; the tokens are not interchangeable.
- **Privacy and lifecycle:** Request only necessary claims, use stable identifiers carefully, protect sessions, manage signing-key rollover, and define logout and account-change behavior explicitly.
- **Important limitation:** A valid ID Token proves only the claims and authentication context asserted by a trusted provider. It does not establish legal identity, current application authorization, or the safety of the resulting local session.

### Related terms

[OAuth 2.0](<https://yellowcube.eu/glossary/oauth-2-0/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Federated identity](<https://yellowcube.eu/glossary/federated-identity/>) · [Single sign-on (SSO)](<https://yellowcube.eu/glossary/single-sign-on/>) · [Authentication token](<https://yellowcube.eu/glossary/authentication-token/>)

### Sources

[OpenID Connect Core 1.0 incorporating errata set 2](https://openid.net/specs/openid-connect-core-1_0.html) · [NIST SP 800-63C-4: Federation and Assertions](https://csrc.nist.gov/pubs/sp/800/63/c/4/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.