Tokens and credentials
ID token
A signed JWT from an OpenID Connect provider carrying verifiable claims about the authenticated user.
What ID token means
An ID token is a signed statement about who authenticated, addressed to your application specifically. It is not a credential for calling APIs — that is the access token — and it is not a session. It is a one-time, verifiable assertion that a particular user authenticated at a particular time.
Defined in: OpenID Connect Core 1.0 §2 and §3.1.3.7.
How it works
Validation is not optional and has five parts: verify the signature against the provider's JWKS, confirm the issuer matches the provider you expect, confirm the audience is your client, confirm it has not expired, and confirm the nonce matches the one you sent. Anything less and the token is just a base64 string that happens to contain plausible fields.
The token carries claims — subject, issued-at, expiry, and whatever the provider includes about the user. The subject claim is the stable identifier for the user at that provider. Email is not: email addresses change, are reassigned, and in a multi-tenant system may not be unique across tenants.
An ID token is not a session. It says authentication happened; it does not say the user is still authorized now. Applications that treat a long-lived ID token as a session discover this when someone needs access removed immediately and nothing happens until it expires.
The mistake people actually make
Keying user records on the email claim rather than the subject claim. It works until a user changes their email address, at which point either they become a new user or two records merge, and both outcomes are difficult to unwind.
Guides that go deeper
- How to implement the OpenID Connect authorization code flow
- How to validate a JWT access token in your API
- JWT vs opaque access tokens: which should you use?
- Logout in OpenID Connect: RP-initiated, front-channel and back-channel
- Step-up authentication: asking for more proof only when it matters
- How to migrate from one identity provider to another
Related terms
OpenID Connect (OIDC)
An identity layer on top of OAuth 2.0 that lets an application verify who a user is, not just what it may access.
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
JWKS
A JSON Web Key Set — the public keys an identity provider publishes so anyone can verify its signed tokens.
Session revocation
Ending an active session so that subsequent requests fail, rather than waiting for a token to expire.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.