OAuth 2.0 handles authorization, OpenID Connect adds authentication. OAuth 2.0 grants access to resources without sharing credentials. Authorization Code flow with PKCE is the recommended grant type. Client ID identifies the application to the authorization server. Redirect URI receives authorization response after user consent. Scope defines requested permissions. Access token grants access to protected resources. Refresh token obtains new access tokens without user interaction. Token expiration limits security exposure. OpenID Connect extends OAuth 2.0 with ID token. ID token is a JWT containing user identity claims. Standard claims include sub, name, email, and picture. UserInfo endpoint returns additional user information. Discovery document at /.well-known/openid-configuration. JWKS endpoint provides public keys for token verification. Authentication event triggers with prompt parameter. Session management detects user logout. Logout redirects end user session across applications. Front-channel and back-channel logout ensure complete session termination. Certification ensures interoperability. Understanding both specifications is crucial for secure identity management.
