🔑ID Token

NEW

A JWT in OpenID Connect that asserts the end-user’s identity via signed claims from the authorization server.

DESCRIPTION

The ID Token is central to OpenID Connect, conveying authenticated user identity and related claims. Unlike access tokens, it is intended for the client and not resource access. ID Tokens are typically signed (JWS) and may be encrypted (JWE), include nonce and audience checks, and follow strict validation rules. Implementations must verify signatures, issuer, audience, expiration, and token replay protections. It enables single sign-on integrations across web and mobile apps.

ALTERNATIVE DEFINITIONS

OpenID Connect Core 1.0

The ID Token is a security token that contains Claims about the authentication of an End-User by an Authorization Server when using OpenID Connect.

Formal specification defining purpose and contents.

Source

Auth0

An ID token is a JWT that contains information about a user’s identity, including claims such as name, email, and a unique identifier.

Developer-oriented explanation listing typical claims.

Source

RELATED TERMS

OpenID Connect JWT OAuth 2.0 Claims JWS JWK

COMPETING TERMS

Access Token

RELATIONS

• Broader: Token

KNOWLEDGE AREAS

Data Security Data Privacy & Compliance Software Engineering Infrastructure

TARGET AUDIENCE

Software Developer Security Architect DevOps Engineer Data Privacy Officer

EXTERNAL SOURCES

• Wikipedia - OpenID Connect#ID Token
• OpenID Foundation - Core specification for OIDC
• Okta - Guide to validating ID tokens
• Auth0 - ID token concepts and usage

TOP QUESTIONS

What is an ID Token in OpenID Connect?

It’s a signed JWT containing user identity claims, issued by the authorization server to the client after authentication.

Category: Overview

How does an ID Token differ from an access token?

An ID Token asserts identity for the client, while access tokens authorize resource access at APIs.

Category: Comparison

What must be validated in an ID Token?

Signature, issuer, audience, expiration, nonce, and token replay protections must be verified.

Category: Requirements

Can ID Tokens be encrypted?

Yes, using JWE. However, signing with JWS is mandatory for trust; encryption is optional.

Category: Definition

What claims are commonly in an ID Token?

Subject (sub), issuer (iss), audience (aud), expiration (exp), and profile claims like name or email.

Category: Example

What are common mistakes with ID Tokens?

Skipping signature verification, misusing ID Tokens for API authorization, and failing nonce checks are frequent errors.

Category: Mistakes

What risks exist with ID Tokens?

Replay attacks or token leakage can occur without proper validation, secure storage, and short lifetimes.

Category: Risk

How to monitor ID Tokens in production?

Track token issuance rates, validation errors, audience mismatches, and signature verification failures.

Category: Observability

Where to learn more about ID Tokens?

Read the OpenID Connect Core specification and vendor guides from Okta or Auth0.

Category: HowTo