oauth-oidc • Advanced

OpenID Connect (OIDC): Identity Layer, ID Tokens & JWKS Key Rotation

OIDC is an identity layer built on top of OAuth 2.0. While OAuth 2.0 provides authorization (Access Tokens for API access), OIDC provides authentication (ID Tokens in JWT format containing user identity claims, signed by the IdP).

Intuitive Mental Model

The Hotel Room Keycard vs Government ID: The Access Token is your hotel room keycard (grants access to Room 304, but doesn't say who you are). The ID Token is your driver's license (proves your name, photo, and identity to the hotel front desk).

Architecture Blueprint & CodeProduction Standard

// OIDC Discovery: GET /.well-known/openid-configuration
// Returns jwks_uri: "https://auth.corp.io/.well-known/jwks.json"

// JWKS Public Key Set:
{
  "keys": [
    {
      "kty": "RSA",
      "kid": "key_2026_01",
      "use": "sig",
      "alg": "RS256",
      "n": "u1g...public_modulus...",
      "e": "AQAB"
    }
  ]
}

Key Architectural Takeaways

•Access Token vs ID Token: Access Tokens are meant for API resource servers; ID Tokens are meant for client applications to render user profiles.
•JWKS Key Rotation: Auth servers publish public keys at /.well-known/jwks.json with matching kid (Key ID) headers, enabling seamless zero-downtime key rotation.

Common Architectural Pitfall

Using an OAuth 2.0 Access Token to authenticate a user on the client side instead of validating an OIDC ID Token.

Production Best Practice

Use OIDC ID Tokens for client-side user identification and Access Tokens strictly for API authorization.

Next: WebAuthn & FIDO2: Biometric Hardware Passkeys & Phishing Defense