ID token
The signed token from OpenID Connect that tells your app who just authenticated, while an access token says what may call an API.
What it is
An ID token is OpenID Connect's signed statement about an authentication event. It is a JWT carrying `iss` for the issuer, `sub` for the user, `aud` for the intended client, and time claims such as `exp` and `iat`. It may also include profile claims such as name and email when the provider releases them.
Reach for it when your app needs to turn an OIDC callback into a local login. Validate the token, then key the external identity on `iss` plus `sub`. The access token returned beside it has a different audience and job: it authorizes calls to an API.
The gotcha is that a JWT-shaped string is not evidence by itself. Verify its signature using the issuer's advertised JWKS, restrict the accepted algorithm, and check issuer, audience, expiry, and nonce. Do not assume an email claim exists or is verified, and do not send an ID token to an API as a bearer token.
Ask AI for it
Validate OpenID Connect ID tokens in Node.js with the `jose` package. Read `issuer`, `jwks_uri`, and supported algorithms from the provider's `/.well-known/openid-configuration`; build a remote key set with `createRemoteJWKSet`; and call `jwtVerify` with the exact issuer, client ID as audience, and an explicit algorithm allowlist. Reject expired tokens and verify the stored login nonce before trusting claims. Key the external account on `iss` plus `sub`, treat `email` as optional, honor `email_verified`, and use the ID token only to create the app session, never as the bearer credential for an API.