The token request hits your endpoint. You must decide if it’s trusted. Oauth 2.0 and OpenID Connect (OIDC) give you the tools to make that decision without leaking data or risking compromise.
Oauth 2.0 is a protocol for delegated authorization. It defines flows for obtaining and using access tokens. These tokens grant scoped permissions from one system to another, without revealing the user’s credentials. Clients request authorization, receive tokens from an Authorization Server, and use them to call protected APIs.
OpenID Connect builds on Oauth 2.0. It adds an identity layer so you can verify who the user is, not just what they’re allowed to do. It uses ID tokens in JWT format, signed by the provider, to carry user identity claims. This means a client can authenticate and authorize in a single process, using a proven standard.
Common Oauth 2.0 flows include Authorization Code, Client Credentials, and Device Code. OIDC typically relies on the Authorization Code flow, extended with the openid scope, to retrieve both access and ID tokens. Security features like PKCE protect against interception attacks. Token validation requires checking signatures, issuer, audience, and expiration.