OIDC vs OAuth2 — Key Differences Between Authentication and Authorization

In this tutorial, you will learn about OIDC vs OAuth2. We cover key concepts, practical examples, and best practices to help you master this topic.

Openid Connect and OAuth2 serve different but complementary purposes: OAuth2 authorizes access to resources, while OIDC authenticates user identity. They are often used together for complete access management.

What You'll Learn

• The fundamental distinction between authentication and authorization
• When to use OAuth2 alone vs. OIDC on top of OAuth2
• How access tokens and ID tokens differ in structure and purpose

Why It Matters

Confusing OAuth2 and OIDC leads to security vulnerabilities. Using an access token to authenticate users is a common mistake that exposes applications to impersonation attacks. Understanding the difference ensures you use the right token for the right purpose.

Real-World Use

Doda Browser uses both protocols: OIDC for "Sign in with Google" (authentication) and OAuth2 for accessing Google Drive APIs (authorization). The ID token identifies the user, while the access token authorizes file operations.

flowchart LR
    subgraph "OAuth2 Only"
        Client["Client"] -->|"Access Token"| API["Resource API"]
        API -->|"Data"| Client
    end
    subgraph "OIDC + OAuth2"
        Client2["Client"] -->|"Auth Request"| IDP["OIDC Provider"]
        IDP -->|"ID Token + Access Token"| Client2
        Client2 -->|"ID Token"| Backend["Your Backend\n(Identity)"]
        Client2 -->|"Access Token"| API2["Resource API\n(Authorization)"]
    end
    style IDP fill:#dbeafe,stroke:#2563eb

Protocol Comparison Table

When to Use Each

Use OAuth2 alone when you only need to authorize access to APIs without knowing the user's identity. For example, a print service that accesses Google Drive files does not need to know who the user is.

Use OIDC when you need to authenticate users and optionally access their resources. For example, a web app that shows "Welcome, Alice!" and also posts to the user's timeline.

Code Example: OAuth2 Only

import requests

# OAuth2: Get access token for Google Drive API
token_resp = requests.post("https://oauth2.googleapis.com/token", data={
    "code": "auth_code",
    "client_id": "client-id",
    "client_secret": "client-secret",
    "redirect_uri": "https://app.com/callback",
    "grant_type": "authorization_code",
})
access_token = token_resp.json()["access_token"]

# Use access token to access Drive API
files = requests.get(
    "https://www.googleapis.com/drive/v3/files",
    headers={"Authorization": f"Bearer {access_token}"}
)
print(f"Files: {files.json()}")

Expected output:

Files: {'files': [{'id': '1x...', 'name': 'document.pdf'}]}

Code Example: OIDC + OAuth2

import jwt

# OIDC: Get both ID token and access token
token_resp = requests.post("https://oauth2.googleapis.com/token", data={
    "code": "auth_code",
    "client_id": "client-id",
    "client_secret": "client-secret",
    "redirect_uri": "https://app.com/callback",
    "grant_type": "authorization_code",
})
tokens = token_resp.json()
id_token = tokens["id_token"]
access_token = tokens["access_token"]

# ID token for authentication
claims = jwt.decode(id_token, options={"verify_signature": False})
print(f"User: {claims['name']} ({claims['email']})")

# Access token for API authorization
files = requests.get(
    "https://www.googleapis.com/drive/v3/files",
    headers={"Authorization": f"Bearer {access_token}"}
)

Expected output:

User: Alice Smith (alice@example.com)

Common Mistakes

1. Authenticating Users with Access Tokens

Access tokens only indicate authorization. They do not contain user identity. An attacker with any valid access token can impersonate a user.

2. Treating ID Tokens as Session Tokens

ID tokens expire quickly. Use them for initial authentication, then create your own session with proper expiration and refresh logic.

3. Confusing azp and aud Claims

azp (authorized party) is the client the token was issued to. aud (audience) is the intended recipient. Both must be verified.

4. Mixing OAuth2 Scopes with OIDC

OAuth2 resources define their own scopes (e.g., drive.file). OIDC scopes (e.g., profile, email) request identity claims. They can coexist.

5. Assuming All OAuth2 Providers Support OIDC

Many OAuth2 implementations do not support OIDC. Check whether the provider supports the openid scope and returns an ID token.

Practice Questions

1. What is the fundamental difference between authentication and authorization?
2. Why should access tokens never be used for authentication?
3. What token does OIDC add that OAuth2 does not provide?
4. Can you use OIDC without OAuth2?
5. How do scopes differ between OAuth2 and OIDC?

Answers:

1. Authentication verifies who the user is (identity). Authorization determines what the user can do (permissions).
2. Access tokens grant API access but do not contain verified user identity. Using them for auth allows token theft to become identity theft.
3. OIDC adds the ID token, a signed JWT containing verified user identity claims from the provider.
4. No. OIDC is built on top of OAuth2 and uses OAuth2 grant types to deliver tokens.
5. OAuth2 scopes control API access permissions. OIDC scopes (profile, email, address) request specific user claims in the ID token.

Challenge: Implement both an OAuth2-only flow and an OIDC flow with the same provider. Compare the tokens returned and document the differences.

FAQ

Mini Project

Create two Python scripts: one that demonstrates OAuth2-only flow (access token, no user identity) and one that demonstrates OIDC flow (ID token with user claims). Compare the tokens and explain when each approach is appropriate.

What's Next

Continue with Understanding ID Tokens to learn about JWT structure and claim validation, or explore UserInfo Endpoint for retrieving additional user data.