Learn: OAuth 2.0 vs OpenID Connect
OAuth 2.0 is about access: it lets an app call an API for the user, with an access token.
OpenID Connect (OIDC) adds login on top: an ID token that says who the user is.
The usual flow for web and mobile apps is the authorization code flow with PKCE: the user logs in at the identity provider, the app gets a code, and swaps it for tokens.
Short version: access token → for the API; ID token → for the app, to know who logged in.
Read more: https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc
#tip · TIP-093
codementor
npub1u6…v0yg2
2026-10-27 18:07:51 UTC
Author Public Key
npub1u69qs4hfpkve0v0hy85s2fycjeqjm4ts8xdfs7ew3l270l87yfuspv0yg2Seen on
wss://relay.primal.netPublished at
2026-10-27 18:07:51 UTCEvent JSON
{
"id": "3200b9c940dcd15e1eb2bd14236a90b19382f2265ef19c0f2ac73e20b6a4862c",
"pubkey": "e68a0856e90d9997b1f721e905249896412dd570399a987b2e8fd5e7fcfe2279",
"created_at": 1793124471,
"kind": 1,
"tags": [
[
"t",
"tip"
]
],
"content": "Learn: OAuth 2.0 vs OpenID Connect\n\nOAuth 2.0 is about access: it lets an app call an API for the user, with an access token.\nOpenID Connect (OIDC) adds login on top: an ID token that says who the user is.\nThe usual flow for web and mobile apps is the authorization code flow with PKCE: the user logs in at the identity provider, the app gets a code, and swaps it for tokens.\nShort version: access token → for the API; ID token → for the app, to know who logged in.\n\nRead more: https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc\n\n#tip · TIP-093",
"sig": "49c05669fcbdafd42eb454c608c4732533adbe1a37bed1593beba01467c441a7227b8d50d65b69c9435e413efa3ffaffcf15685f07cfb9f2d3f1eaec1332e49c"
}