01. OAuth and OpenID

 

OAuth and OpenID

 

01. OAuth (Think: Valet Key for Your Car)

What it is:

OAuth (Open Authorization) is all about authorization. It's a way for us to grant one application (like a photo printing service) permission to access our data in another application (like your Google Photos) without giving it your actual password for Google Photos.

 02. OpenID Connect (OIDC) (Think: Showing Your ID at a Bar)

What it is:

OpenID Connect is all about authentication. It's a layer built on top of OAuth 2.0. It allows you to use one login (like your Google or Facebook account) to sign in to other websites or apps

Key Difference

• OAuth = About access ("Can this app use my data?")
• OIDC = About identity ("Is this really John Doe?")

 

Real-World Use

• Pure OAuth: Allowing a finance app to read your bank transactions
• OIDC: Logging into that finance app using your Google account

 

Without OAuth 2.0, OIDC would not exist.

Without OIDC , OAuth 2.0 can exist.

So, we can use OAuth without OpenID. But we cannot use OpenID without OAuth.

OpenID 1.0 (2005) was a separate protocol but OpenID Connect (2014) was created to merge identity + OAuth because It didn’t handle authorization (OAuth’s job)

  

Example: Pure OAuth (No OIDC)

GET /authorize?response_type=code&client_id=123&scope=read:orders write:orders

Then Returns `access_token` JWT (, by default it is Base64 encoded) only to call APIs (no `id_token` which include user identity info).

 Example: OIDC (Requires OAuth)

GET /authorize?response_type=code&client_id=123&scope=openid email profile read:orders write:orders

Then Returns `access_token` and `id_token` JWT (`id_token` which include user identity info, by default it is Base64 encoded).

id_token: We must validate the ID token, just like we validate an access token — especially in production.

 

Sample Authorization URL

https://your-domain.auth.us-east-1.amazoncognito.com/authorize?

  response_type=token&

  client_id=abc123xyz456&

  redirect_uri=https://your-app.com/callback&

  scope=openid email profile read:profile write:settings

• response_type=token:Requests an **access token** directly (implicit flow – for frontend apps).
• client_id: Your app's client ID from Cognito. 
• redirect_uri:The URI Cognito redirects to after login.                                                                       
• scope:What you're requesting: identity info (`openid`, `email`, `profile`) + API access (`read:profile`, `write:settings`)

Sample Response (Redirected to Frontend)

https://your-app.com/callback#

  access_token=eyJraWQiOicdsadsadsaAASDFsdf // JWT, by default it is Base64 encoded

  &id_token=AAddSwfdssdfsddsfsdeyJraWQiOi  // JWT, by default it is Base64 encoded

  &expires_in=3600

  &token_type=Bearer

 

• access_token: used to call your protected APIs (which check scopes like read:profile, etc.).
• id_token: a JWT with user identity info (email, name, etc.) — decode this to read claims.
• expires_in: token expiration in seconds (usually 3600 = 1 hour).

 {

  "sub": "1234567890",

  "name": "John Doe",

  "email": "john@example.com",

  "iat": 1516239022

}