What is an OpenID Connect?

OAuth 2.0 by design only handles authorization, granting scoped access to resources, and deliberately leaves authentication, proving identity, undefined, which led to inconsistent, insecure home-grown login integrations before OIDC standardized it. OIDC adds a JSON Web Token called the ID token, cryptographically signed by the identity provider, containing verified claims about the user, their subject identifier, email, and other profile data, that the receiving application can validate without a separate round-trip to the provider. This is what powers standard sign-in-with-Google or sign-in-with-Microsoft buttons: the application redirects to the provider's OIDC-compliant authorization endpoint, the user authenticates there, and the app receives back both an OAuth access token, for any API access it also requested, and an OIDC ID token confirming exactly who logged in. OIDC also standardizes a discovery document and JWKS endpoint so relying parties can automatically fetch the provider's signing keys and configuration rather than hardcoding them.