Quiz Entry - updated: 2026.10.22
How do OAuth 2.0 and OpenID Connect differ?
OAuth 2.0 is an authorisation framework (what may this app access?) built around the access token; OpenID Connect is an authentication layer on top of it (who is this user?) that adds the openid scope, the signed ID token, the UserInfo endpoint and standardised claims.
| OAuth 2.0 | OpenID Connect | |
|---|---|---|
| Purpose | Delegated authorisation | Authentication and identity |
| Question answered | What may the client access? | Who is the user, and how did they log in? |
| Central artefact | Access token (format undefined) | ID token (always a signed JWT) |
| Roles | Client, authorization server, resource server, resource owner | Relying party (RP), OpenID Provider (OP), end user |
| User information | None standardised | UserInfo endpoint and standard claims |
| Activation | — | openid in the scope |
| Session and logout | Not covered | Session management and logout specifications |
| Discovery | Separate RFC (authorization server metadata) | Discovery 1.0, part of the suite |
The two are not alternatives: every OIDC flow is an OAuth flow. If an application only needs to call an API on the user's behalf, OAuth suffices; as soon as it needs to know who the user is, it needs OIDC.
Go deeper:
OktaDev: OAuth 2.0 and OpenID Connect (in plain English) — the clearest explanation of where OAuth stops and OIDC starts.
Okta Developer: An Illustrated Guide to OAuth and OpenID Connect — both protocols as an illustrated story.