Protocols
Nonce (OpenID Connect)
A random value a client sends on the authentication request and checks in the ID token, to stop token replay.
What Nonce (OpenID Connect) means
In OpenID Connect, the nonce is a random value the client sends with the authentication request and the provider copies into the ID token. The client checks they match, which binds the ID token to this specific sign-in and prevents an ID token captured elsewhere from being replayed into the client's session.
Defined in: OpenID Connect Core 1.0, sections 3.1.2.1 and 3.1.3.7.
How it works
The client stores the nonce (or a value it was derived from) in the user's pre-login session. When the ID token arrives, its nonce claim must equal it exactly; then the stored value is discarded.
Nonce and state solve related problems: state protects the redirect endpoint against CSRF; nonce protects the ID token against replay. OpenID Connect Core requires nonce for the implicit flow and recommends it generally.
The mistake people actually make
Generating a nonce and never checking it in the ID token, which provides no protection at all.
In Authreads
How this applies here
Authreads requires a non-empty nonce on OpenID Connect authorization requests.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Related terms
ID token
A signed JWT from an OpenID Connect provider carrying verifiable claims about the authenticated user.
OpenID Connect (OIDC)
An identity layer on top of OAuth 2.0 that lets an application verify who a user is, not just what it may access.
PKCE
Proof Key for Code Exchange — binds an authorization code to the client that requested it, so a stolen code is useless.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.