OAuth 2.0 & OIDC flows

The fastest way to lose credibility in an identity screen is to say "we'll use OAuth to log the user in." OAuth doesn't log anyone in. Naming that boundary cleanly is the first thing a sharp interviewer listens for.

OAuth 2.0 is an authorization framework - it answers "can this client call this API on the user's behalf" and hands back an access token. OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. is a thin identity layer on top that adds an ID token, a signed JWT stating who the user is. You ask OAuth for permission to act; you ask OIDC who just authenticated.