The encyclopedia · Software & IT · Technical decision · 2007–2014
OpenID Connect made 'log in with Google' a standard by layering identity onto OAuth 2.0
OIDC adds an identity layer to OAuth 2.0: one sign-in flow returns a signed JSON ID token, so sites verify users without storing passwords.
OpenID Foundation
The solution
Sharing passwords between apps was the standard workaround for "log in with my account," and it leaked credentials everywhere. OAuth 2.0 solved delegated authorization but not authentication: an app could get access, yet still could not verify who the user was.
OpenID Connect adds exactly that missing identity layer on top of OAuth 2.0. It launches a sign-in flow with an authorization server and returns an ID token — a signed JSON Web Token with standard claims about the user — in an interoperable, REST-like manner.
Because it reuses OAuth 2.0 infrastructure and JSON, developers could adopt it without learning a new transport or parsing a new format. It also removes the responsibility of setting, storing and managing passwords, reducing the risk of credential-based breaches.
Why it worked
- Building on OAuth 2.0 meant reusing existing flows and infrastructure.
- A JSON ID token is easy to verify in any language.
- Standard claims (name, email) cover most needs out of the box.
- Users keep their password with the identity provider, not every app.
What can be applied
Don't invent a new protocol if a trusted one exists: add the missing layer to what everyone already implements, and make the output a format every developer already parses (JSON).
Aftermath
OIDC is the standard behind "Sign in with Google, Facebook, Apple and Microsoft," widely deployed across web, mobile and JavaScript clients; the OpenID Foundation certifies implementations to guarantee interoperability.
Sources
spotted an error? The archive wants to know.