Search code examples
openid-connect

What is the meaning of ID token in oidc?

I'd token carries email, aud etc. fields. Why the client needs the ID token, having userInfo endpoint in Idp exposed to the client?

Solution

  • The ID token represents how the user authenticated and some details about the user. A common use of this token is to create a session cookie based on it.

    The ID token usually has a very short lifetime, like 5 minutes, so after the session is created, then its purpose is very limited.