Quiz Entry - updated: 2026.10.22
Why must an ID token not be used as an access token to call an API?
Because the ID token's audience is the client (RP): it tells the client who logged in. The access token's audience is the resource server: it tells the API what the client may do. Each is validated by a different party for a different purpose.
| ID token | Access token | |
|---|---|---|
| Defined by | OpenID Connect | OAuth 2.0 |
| Audience | The client (aud = client ID) |
The resource server (API) |
| Answers | Who is the user, and how did they log in? | What may the bearer access? |
| Format | Always a JWT | Undefined: opaque string or JWT |
| Who reads it | The client, which validates it | The resource server; the client should treat it as opaque |
| Sent to | Stays with the client (and as id_token_hint at logout) |
Every API request: Authorization: Bearer ... |
Mixing them up causes real vulnerabilities. An API that accepts ID tokens would accept a token whose audience is some other application, so any app that received the user's ID token could call the API as that user. In the other direction, a client that treats an access token as proof of login falls into the pseudo-authentication trap.
Tip: ID token = identity card shown to the app. Access token = door key shown to the API.
Go deeper:
oauth.net: End User Authentication with OAuth 2.0 — includes why access tokens are not proof of authentication.- oose: OAuth, OpenID Connect und JWT, wie hängt das alles zusammen? (Teil 2) — ID token and access token side by side (in German).