OpenID Connect

OpenID Connect is a defined procedure for logging in on the internet. It governs how a website securely finds out who is currently sitting in front of the screen. In doing so, the website does not ask for a password itself. Instead, it sends the user to another provider where they already have an account, for example Google, Microsoft, or Apple. This provider verifies the identity and then reports back to the website: this person is genuine, and this is their name. Because everyone involved follows the same rules, this works across company boundaries. The abbreviation OIDC stands for exactly this set of rules.

Why nobody wants to manage fifty passwords anymore

In the past, every website set up its own account with its own password. This led to two problems. First, many people used the same password everywhere. If a single site got hacked, all other accounts were left exposed. Second, even the smallest website had to store passwords securely, and many simply could not do that.

OIDC shifts this responsibility to where it is better placed. Now only a single major provider knows the password and protects it with considerable effort. The website itself no longer stores any password and consequently cannot lose one either. In addition, two-factor authentication can be enabled with the provider, meaning a second confirmation via phone or security key. This protection then immediately applies to all services accessed through that account.

For companies, another point is crucial. If an employee leaves the company, her central account is locked. This removes access to all connected programs in a single step. Without such a procedure, someone would have to manually disable dozens of individual accounts and would almost certainly overlook one.

The ID card that the login service issues

The process always follows the same pattern. You click the login button and land on the provider’s page. There you enter your credentials, which the original website never gets to see. Afterward, you are redirected, and in tow is a so-called ID token.

This ID token is a small file containing information about the person: a unique number, often the name and email address, plus an issue time and expiration date. You can think of it like an ID card that the provider prints fresh. What matters is the digital signature on it. It is a mathematical signature that can be verified but not forged. The website recalculates this signature and thereby knows that the token really did come from the provider.

Technically, OIDC builds on an older procedure called OAuth 2.0. This is an important distinction that is often confused. OAuth governs permissions, in other words the question: is this app allowed to access my calendar? OIDC adds the question of identity: who are you in the first place? That’s why OIDC is said to be an identity layer on top of OAuth. Incidentally, a token usually expires after minutes or hours, so that a stolen ID card quickly becomes worthless.

From the login button to the corporate network

OIDC is most visible in every button labeled “Continue with Google” or “Sign in with Apple.” Logins via Microsoft, GitHub, or Discord accounts also almost always run through it. Anyone who has used an online game, a learning app, or a forum without a new registration has already used this procedure without knowing its name.

In companies and schools, it powers single sign-on, meaning a one-time login for many programs. You log in once in the morning and afterward reach email, cloud storage, and the learning platform without any further input. Providers such as Microsoft Entra ID, Okta, or Keycloak specialize in this role.

In tech news, the term usually comes up in two contexts. Either it’s about a security vulnerability in which attackers stole valid tokens, or about corporate acquisitions in the identity services market. OIDC is also becoming more important for AI tools, because an assistant is supposed to access a user’s data on their behalf. In that case, it must be clearly established who the user is and what the program is allowed to do for them.