Use OpenID Connect (OIDC) to authenticate users, and use OAuth access tokens plus explicit authorization rules to protect REST API resources. An ID Token tells a client about an authentication event; it is not automatically a credential for calling your API. Keep those roles separate, validate each token for its intended audience, and authorize every API action.
What OIDC does—and what your API still must do
OIDC adds an identity and authentication layer to OAuth 2.0. A client requests the openid scope and, after a successful sign-in, receives an ID Token containing claims about the authentication event. OAuth access tokens are credentials for access to protected resources. The OpenID Foundation’s OIDC Core specification defines these distinct purposes.
| Role or artifact | Purpose | What to check |
|---|---|---|
| Client (or relying party) | Starts sign-in and uses the authentication result; in a web application it may establish a local session. | Validate the ID Token as a client, using the expected issuer and client identifier. |
| OpenID Provider (OP) | Authenticates the user and issues OIDC responses and tokens. | Configure a trusted issuer and obtain its metadata and signing keys through trusted configuration. |
| ID Token | Reports the authentication event and identity claims to the client. | Its audience is the client. Do not treat it as an API access token unless a specific, documented profile says otherwise. |
| Access token | Authorizes access to a protected resource, such as an API. | The resource server validates it according to the issuer’s supported token format and profile. |
| Resource server | The API that receives access tokens and serves protected resources. | Validate the token for this API, then decide whether the principal may perform the requested action. |
OIDC Core defines sub as unique within an issuer, not necessarily across all issuers. If your application needs a stable identity key, use the pair iss and sub; do not assume that a subject value alone is globally unique. Authentication establishes who the client believes signed in. It does not decide whether that person may read a particular record, change a setting, or perform an administrative action.
How do I secure a REST API with OpenID Connect?
Use a standards-based sign-in flow to obtain identity, then give the API a separately validated access token and enforce resource-level policy on each request. For a typical server-side web application, the flow is Authorization Code. OIDC Core specifies the flow and token exchange; RFC 9700, the IETF’s January 2025 OAuth 2.0 Security Best Current Practice, informs the security choices around redirects, clients, and tokens.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11#1 Best Overall
- Configure a trusted issuer. Select the provider and issuer through application configuration or another trusted administrative channel. Use its discovery metadata and keys only after establishing that the configured issuer is the one your application intends to trust.
- Start an authorization request. Redirect the browser to the provider’s authorization endpoint with the registered client identifier, exact registered redirect URI, requested scopes including
openid, and a response type for Authorization Code flow. Generate and retain a one-timestatevalue to bind the response to the initiating browser session. Include anoncewhen using it to bind the eventual ID Token to the request. Use PKCE where supported: the client sends a code challenge in the authorization request and retains the verifier for the exchange. - Handle the redirect narrowly. Accept the authorization response only at the registered redirect URI, verify
state, and reject unexpected or mismatched responses. Register precise redirect URIs rather than broad patterns or untrusted destinations. - Redeem the code from the client. Send the authorization code to the provider’s token endpoint over TLS, with the PKCE verifier when used and the client authentication required for that client type. Authorization codes are short-lived credentials; do not put them in logs or expose them to unrelated code.
- Validate the authentication response. Validate the ID Token before treating the sign-in as successful. If validation succeeds, establish the application’s own session when that is the chosen architecture.
- Call the API with an access token. The client obtains and presents an access token intended for the API. The API validates that token and applies its own authorization policy; it does not rely on the client’s ID Token or session as a substitute for API authorization.
For a browser-based or native client calling an API directly, the precise client and token-handling design depends on the provider’s supported profile and the application architecture. Use Authorization Code with PKCE where supported, and avoid inventing a token flow from assumptions about a different client type.
How do I validate an OpenID Connect token?
First determine which token you are validating and which component is responsible. The client validates an ID Token as evidence of the authentication response. The API resource server validates an access token as authorization for that API. A token that can be base64-decoded or parsed as a JWT is not thereby authentic: an attacker can create a syntactically valid token. OIDC Core describes signed JWTs as a way to detect manufacture or modification, while the relying party must still perform the required checks.
ID Token checks at the client
- Signature and algorithm: Verify the signature using keys associated with the configured issuer, and allow only signing algorithms the implementation intentionally supports. Do not select an issuer or verification key based on untrusted token contents.
- Issuer: Require
issto match the configured issuer exactly. In OIDC discovery, the issuer identifier’s path component matters; a similar-looking hostname or a different path is not an equivalent issuer. - Audience and authorized party: Require the client’s identifier in
aud. When an ID Token has multiple audiences, checkazpas required by the applicable OIDC validation rules. - Time claims: Reject expired tokens using
exp; checkiatandnbfwhere applicable, with a deliberate clock-skew policy. The permitted skew should not be an excuse to accept materially expired or not-yet-valid tokens. - Request binding: If the sign-in request used a
nonce, require the corresponding value in the ID Token. Also verify the authorization response’sstateagainst the value retained for that browser session.
Access-token checks at the API
Validate the access token using the method defined by the provider and the applicable protocol profile. Some deployments use signed JWT access tokens, while others use opaque tokens and an introspection mechanism. Do not assume every access token is an OIDC ID Token or even a JWT. For a JWT access token, verify its signature against trusted issuer keys, accept only intended algorithms, check the expected issuer and the API’s audience, and enforce expiry and applicable time claims. For an opaque token, use the trusted validation mechanism configured for the resource server rather than attempting to parse it locally.
Reject tokens with an unexpected issuer, wrong audience, invalid signature, or unacceptable time claims. A successful cryptographic validation establishes that the token meets the configured validation rules; it does not grant unrestricted access to every route. OIDC Core and the provider’s access-token profile determine token semantics, so configure API validation for that contract rather than borrowing ID Token rules wholesale.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Authorize each API request and protect the REST surface
Once an access token is accepted, map its validated claims to an authenticated principal and evaluate the requested operation. OWASP’s REST Security Cheat Sheet provides API-layer guidance, and its Authentication Cheat Sheet complements it with general authentication and session practices. These operational controls are recommendations for API design, not a replacement for protocol validation.
- Check subject, resource, and action. Decide whether this principal may perform this action on this particular object. A broad role or scope alone may not answer ownership, tenant, or record-level questions.
- Apply least privilege. Request and grant only the scopes or roles needed. Define policies for missing or insufficient permissions rather than treating a valid token as blanket authorization.
- Require TLS in transit. Protect API traffic and the authorization-code exchange. OIDC Core requires TLS for the token endpoint.
- Use the Authorization header. Send credentials in the expected authorization header, not in URL parameters, which can leak through browser history, logs, referrers, or monitoring systems.
- Validate inputs and limit abuse. Validate request data independently of authentication, set appropriate rate limits, and use safe error responses that do not disclose secrets or internal implementation details.
- Keep credentials out of logs. Do not log authorization codes, access tokens, ID Tokens, client secrets, or other sensitive credentials. Log security-relevant events using identifiers and metadata that do not expose bearer credentials.
Operational safeguards that keep the design trustworthy
Token validation depends on more than the code path handling a request. Protect client credentials and signing keys, and define how issuer metadata and signing keys are refreshed. Key rotation can cause validation failures if a resource server never refreshes trusted keys; conversely, accepting arbitrary keys from a token defeats the trust boundary. Follow the provider’s documented rotation and cache behavior.
Rank #4
- Keep authorization artifacts short-lived and tightly handled. Treat authorization codes and bearer tokens as secrets. Restrict where they are stored and transmitted, and avoid exposing them to browser scripts or unrelated services without a deliberate architecture.
- Protect application sessions. If the web client creates a session after OIDC sign-in, use secure cookie settings and the application’s established anti-forgery protections. OIDC does not automatically secure the application session.
- Make clock assumptions explicit. Synchronize system clocks and configure a small, intentional tolerance for clock differences when evaluating time claims.
- Plan failures and rotation. Decide how the service responds when metadata is unavailable, keys rotate, introspection fails, or a provider is unreachable. Fail closed for protected operations rather than silently accepting unvalidated credentials.
- Use maintained protocol libraries. Prefer a maintained OIDC/OAuth library configured for the provider’s current profile over hand-rolled JWT parsing or copied configuration whose assumptions may not match your issuer.
Do I need FAPI for my API?
Not automatically. FAPI 2.0 is a stronger, specialized OpenID Foundation security profile for higher-assurance API deployments. A conventional OIDC/OAuth deployment can be appropriate for many APIs when its threat model, client design, validation, and resource authorization are sound. Consider FAPI when regulatory, financial, organizational, or threat-model requirements justify its additional controls and the participating systems support them.
| Consideration | Ordinary OAuth/OIDC deployment | FAPI 2.0 |
|---|---|---|
| Assurance and threat model | Choose controls to meet the application’s risks and provider-supported profile. | Designed for higher-assurance use; assess whether its stronger profile addresses actual obligations and threats. |
| Controls | Use Authorization Code with PKCE where supported, precise redirect registration, response binding, TLS, and secure token handling. | Includes Authorization Code and PKCE with additional profile controls such as PAR and sender-constrained access tokens using DPoP or mutual TLS. |
| Provider and client support | Confirm that the issuer and maintained client/resource-server libraries support the selected flow and token validation method. | Confirm support across authorization server, clients, APIs, and libraries; profile interoperability must be planned. |
| Operational cost and interoperability | Requires sound configuration and ongoing key, credential, session, and token operations. | Can add pushed authorization requests, proof-of-possession mechanisms, certificates or keys, and integration work; weigh that effort against the assurance requirement. |
Sender-constrained tokens such as DPoP or mutual TLS can reduce the value of a stolen token by binding its use to a key or client connection, but they add deployment and interoperability requirements. FAPI does not remove the need to validate tokens or authorize each resource and action.
Best Value
- Used Book in Good Condition
Implementation checklist
- Choose and pin a trusted issuer; use its discovery metadata and associated keys through trusted configuration.
- Use Authorization Code flow, exact redirect URI registration, response-state protection, nonce validation when used, and PKCE where supported.
- Exchange codes only at the trusted TLS-protected token endpoint; protect all codes, tokens, secrets, and keys.
- Validate ID Tokens at the client and access tokens at the resource server, each against its own issuer, audience, time, signature, and profile requirements.
- Authorize every API operation against the principal, requested resource, scopes or roles, and application policy.
- Set operational policies for key refresh, rotation, clock skew, session cookies, rate limits, safe errors, and secret-safe logging.
- Use a maintained implementation library and verify its behavior against the provider’s current supported profile and relevant standards.
The normative baseline is OpenID Connect Core 1.0 incorporating errata set 1, alongside RFC 9700 for OAuth security best practice. OWASP REST and Authentication Cheat Sheets provide complementary implementation guidance. Provider behavior and library support vary, so confirm current configuration and profile requirements before deploying.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
