OpenID Connect

OpenID Connect 1.0 identity layer on top of OAuth 2.0

Start with Recommended FlowRecommended Flow Open Looking Glass

Available Flows

OIDC Authorization Code Flow

OpenID Connect 1.0 authentication using the OAuth 2.0 Authorization Code flow (OIDC Core §3.1). Adds an ID Token containing identity claims about the authenticated user. Most secure flow for server-side applications.

ID Token (JWT)UserInfo EndpointVerified Identity

View flow diagram

OIDC Implicit Flow (Legacy)

OpenID Connect Implicit flow returns tokens directly from the authorization endpoint (OIDC Core §3.2). ⚠️ DEPRECATED: Not recommended for new applications due to token exposure in browser history and URL. Use Authorization Code + PKCE instead.

Legacy FlowDirect Token ResponseNot Recommended

View flow diagram

OIDC Hybrid Flow

Combines Authorization Code and Implicit flows (OIDC Core §3.3). Returns ID Token immediately for fast identity verification while authorization code is exchanged securely server-side. Useful when client needs identity before backend token exchange completes.

View flow diagram

UserInfo Endpoint

Protected resource that returns claims about the authenticated End-User (OIDC Core §5.3). Access requires a valid access token with 'openid' scope. Returns claims based on granted scopes (profile, email, address, phone).

View flow diagram

OpenID Connect Discovery

Auto-configuration mechanism that allows Relying Parties to discover the OpenID Provider's endpoints, supported features, and cryptographic capabilities (OIDC Discovery §4). Essential for dynamic client registration and multi-provider support.

View flow diagram

OpenID Connect Features

ID Token (JWT)

JWT containing verified identity claims (sub, name, email)

UserInfo Endpoint

API endpoint returning additional user claims

Discovery Document

Auto-configuration via /.well-known/openid-configuration