ID Tokens & Claims
Examine the structure and contents of the ID Token, a JSON Web Token (JWT) that carries identity claims about the user.
The Identity Token Revealed
The ID Token is a core component of OpenID Connect (OIDC). Think of it as a digital ID card for the user.
Its main purpose is to provide your application with verified identity information about the end-user who just logged in. It tells you who the user is.
Crucially, an ID Token is different from an Access Token. While an Access Token is for authorization (what you can do), an ID Token is for authentication (who you are).
ID Token's Secret: It's a JWT!
Every ID Token is a JSON Web Token (JWT). JWTs are a compact, URL-safe means of representing claims to be transferred between two parties.
Being a JWT means ID Tokens have a specific, standardized structure that allows for secure and verifiable information exchange.
This standardized format makes it easy for different systems to understand and process identity information.
All lessons in this course
- OIDC: Identity Layer on OAuth2
- ID Tokens & Claims
- OIDC Flows Overview
- The UserInfo Endpoint