OpenID Connect and ID tokens

Authentication and authorization Mid-level Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Pick the fix

A user signs in with Google. How should your database identify them?

Options
Hint 1 of 1

Which claim never changes for that user?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A By the issuer and the sub claim from the verified ID token

Correct. Stable and unique per provider.

The OpenID Connect spec guarantees that issuer plus sub is unique and never reassigned for a user. Email can change or be reused, so it's profile data, not a key.

Why not the others?
  • B By email address. Emails change and may be unverified.
  • C By the access token. Tokens expire and rotate.
  • D By display name. Neither unique nor stable.

30-second answer

OpenID Connect is an identity layer on OAuth 2.0: with the openid scope, the provider returns an ID token, a signed JWT describing who signed in (sub, iss, aud, exp, nonce, often email). Your backend verifies it like any JWT, checks aud is your client id and the nonce matches what you sent, then maps the stable iss + sub pair to a local user. The access token is for calling APIs; the ID token is for your app to know the user.

Practise saying it · 30 s. No recording, just a timer

What does OIDC add?

Say your answer out loud, then check which of these points you covered:

  • Identity on OAuth
  • ID token JWT
  • Verify aud and nonce
  • Key on iss + sub
  • Tokens for their purpose

Deep dive

Key users by (iss, sub), not by email; emails change and can be reused.

Check email_verified before trusting an email for account linking.

Discovery: /.well-known/openid-configuration lists endpoints and the JWKS URL.

Don't send ID tokens to APIs as bearer tokens.

Common mistakes

  • Identifying users by email alone.
  • Skipping nonce validation.
  • Using the access token to decide who logged in to your app.

Senior take & follow-ups

OIDC = identity on OAuth; verify the ID token, key on iss+sub, keep tokens to their purpose.

Follow-up questions

Think of your answer first, then open the hint.

  1. Why (iss, sub)?

    Show hint

    sub is unique only within an issuer and never reassigned.

  2. ID token or access token for APIs?

    Show hint

    Access token.

Related questions

Try it in a free tool

  • JWT decoder Header, claims and expiry, with signature check.

Suggest a fix if something here is wrong or out of date.