Understanding OAuth 2.0 and OpenID Connect

If you work with APIs, you will inevitably encounter OAuth 2.0. It is the industry standard for protocol authorization. Often used alongside it is OpenID Connect (OIDC), which adds an identity layer on top. This article explains how they work together.

What is OAuth 2.0?

OAuth 2.0 is an authorization framework that enables applications to obtain limited access to user accounts on an HTTP service. It delegates authentication to the service that hosts the user account and authorizes third-party applications to access the user account.

Key Concept: It allows you to give an app access to your data without giving it your password. (e.g., "Log in with Google").

The Roles

Resource Owner: The User (You).

Client: The Application attempting to access the user's account (e.g., Apidog, a mobile app).

Authorization Server: The server presenting the login screen and issuing tokens (e.g., Google's Auth Server, Auth0).

Resource Server: The API hosting the protected data (e.g., Google Drive API).

Common Grant Types

Technically called "flows," these determine how the client gets the token.

Authorization Code Flow: The Gold Standard. Used for server-side apps and mobile/SPA apps (with PKCE).

User is redirected to the Auth Server -> Logs in -> Auth Server redirects back with a "Code" -> Client exchanges Code for Token.

Client Credentials Flow: Used for machine-to-machine (M2M) communication.

Service A talks to Service B using a Client ID and Secret. No user is involved.

What is OpenID Connect (OIDC)?

OAuth 2.0 is strictly for authorization (access). It doesn't tell the Client who the user is or when they logged in. This is where OIDC comes in.

OIDC is a thin identity layer on top of OAuth 2.0.

OAuth provides an Access Token (The key to the door).

OIDC provides an ID Token (The ID card saying who you are).

If you use OIDC, you get both tokens in the response. The ID Token is usually a JWT (JSON Web Token) containing user profile data (email, name, picture).

The Flow in Action (Auth Code)

User clicks "Login": The app redirects the browser to the Authorization Sever.

User Authenticates: The user enters credentials on the Authorization Server's page.

Consent: The user approves the app's request ("Access your contacts?").

Code Exchange: The Server redirects back to the App with a one-time code.

Token Request: The App sends the Coe + Client Secret (or PKCE verifier) to the Auth Server.

Response: The Auth Server validates the code and returns:

access_token: To call the API.

id_token: To identify the user.

refresh_token: To get new access tokens when the old one expires.

Key Takeaways

OAuth 2.0 handles Access: Use it to let App A access App B's resources.

OIDC handles Identity: Use it to log users in and get their profile info.

Never handle passwords: With these protocols, your app never sees the user's password, reducing security risk.

Next Step: These protocols rely heavily on a specific token format. You see it everywhere: ey.... Let's learn about JSON Web Tokens (JWT).

Understanding OAuth 2.0 and OpenID Connect

What is OAuth 2.0?#

The Roles#

Common Grant Types#

What is OpenID Connect (OIDC)?#