--- title: How OIDC Works | daily.dev description: An explainer covers how OpenID Connect (OIDC) extends OAuth to add authentication, contrasting ID tokens (proof of identity) with access tokens (proof of... canonical: https://daily.dev/posts/how-oidc-works-jjovme0px twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How OIDC Works | daily.dev og:description: An explainer covers how OpenID Connect (OIDC) extends OAuth to add authentication, contrasting ID tokens (proof of identity) with access tokens (proof of... og:url: https://daily.dev/posts/how-oidc-works-jjovme0px og:image: https://api.daily.dev/og/posts/jjoVme0px.png og:image:alt: How OIDC Works og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How OIDC Works **[Teleport](https://daily.dev/sources/teleport)** · 15 min read · 0 upvotes · 0 comments ## Summary An explainer covers how OpenID Connect (OIDC) extends OAuth to add authentication, contrasting ID tokens (proof of identity) with access tokens (proof of authorization). It walks through federated identity, the authentication vs authorization distinction, and compares OIDC to SAML in terms of protocol design and typical use cases. A detailed case study demonstrates the full Authorization Code Grant flow using Teleport and Okta as the identity provider, including the actual HTTP requests, parameters, and JWT payloads exchanged at each step. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between an OIDC ID token and an OAuth access token? An ID token is proof of authentication, issued as a JWT containing user claims like name and email, similar to an ID card. An access token contains no identifiable user information and only authorizes access to resources, and can be obtained without user involvement, such as through a refresh token exchange, so it cannot serve as proof that a human authenticated. _Understanding token types clearly matters when debugging SSO flows, a topic developers track on daily.dev._ ### What is the mandatory scope required to get an ID token in OIDC? The openid scope is the only mandatory parameter needed for an OIDC-compatible identity provider to issue an ID token alongside the access token. Additional standardized claims like email can be requested optionally to get more user data without needing to define custom scopes per provider, unlike plain OAuth where scopes are not standardized across resource applications. _Developers configuring SSO integrations follow OIDC scope details like this on daily.dev._ ### How does the OAuth Authorization Code Grant flow work with Okta as an OIDC provider? A client redirects the user to Okta's authorization endpoint with client_id, redirect_uri, scope, and state parameters; Okta returns an authorization code to the redirect URI, which the client exchanges at Okta's token endpoint using client_id, client_secret, and the code to receive an id_token and access_token as a JSON payload, with the id_token decoded as a JWT containing claims such as sub, iss, aud, and email. _Engineers wiring up enterprise SSO reference concrete OIDC flow steps like this via daily.dev._ ## Similar posts on daily.dev - [How to Secure APIs with OAuth 2.1 and OpenID Connect](https://daily.dev/posts/how-to-secure-apis-with-oauth-2-1-and-openid-connect-rf7g6orkv) · C\# Corner · 0 upvotes · 1 comments - [Guide to Setting Up OpenID Connect for Enterprises](https://daily.dev/posts/guide-to-setting-up-openid-connect-for-enterprises-mxy3miklx) · Security Boulevard · 0 upvotes · 0 comments - [What is OAuth?](https://daily.dev/posts/what-is-oauth--tu5v1pe2m) · Hacker News · 17 upvotes · 0 comments - [How OAuth works: GitHub and Google login explained](https://daily.dev/posts/how-oauth-works-github-and-google-login-explained-z7bhexnib) · Flavio Copes · 1 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth), [#okta](https://daily.dev/tags/okta) [View this post on daily.dev](https://daily.dev/posts/how-oidc-works-jjovme0px) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How OIDC Works","url":"https://daily.dev/posts/how-oidc-works-jjovme0px","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-oidc-works-jjovme0px"},"datePublished":"2026-08-23T12:21:58.179Z","dateModified":"2026-08-23T12:41:43.883Z","description":"An explainer covers how OpenID Connect (OIDC) extends OAuth to add authentication, contrasting ID tokens (proof of identity) with access tokens (proof of...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-oidc-works-jjovme0px","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,oauth,okta","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How OIDC Works"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-oidc-works-jjovme0px#faq","mainEntity":[{"@type":"Question","name":"What is the difference between an OIDC ID token and an OAuth access token?","acceptedAnswer":{"@type":"Answer","text":"An ID token is proof of authentication, issued as a JWT containing user claims like name and email, similar to an ID card. An access token contains no identifiable user information and only authorizes access to resources, and can be obtained without user involvement, such as through a refresh token exchange, so it cannot serve as proof that a human authenticated. Understanding token types clearly matters when debugging SSO flows, a topic developers track on daily.dev."}},{"@type":"Question","name":"What is the mandatory scope required to get an ID token in OIDC?","acceptedAnswer":{"@type":"Answer","text":"The openid scope is the only mandatory parameter needed for an OIDC-compatible identity provider to issue an ID token alongside the access token. Additional standardized claims like email can be requested optionally to get more user data without needing to define custom scopes per provider, unlike plain OAuth where scopes are not standardized across resource applications. Developers configuring SSO integrations follow OIDC scope details like this on daily.dev."}},{"@type":"Question","name":"How does the OAuth Authorization Code Grant flow work with Okta as an OIDC provider?","acceptedAnswer":{"@type":"Answer","text":"A client redirects the user to Okta's authorization endpoint with client_id, redirect_uri, scope, and state parameters; Okta returns an authorization code to the redirect URI, which the client exchanges at Okta's token endpoint using client_id, client_secret, and the code to receive an id_token and access_token as a JSON payload, with the id_token decoded as a JWT containing claims such as sub, iss, aud, and email. Engineers wiring up enterprise SSO reference concrete OIDC flow steps like this via daily.dev."}}]} ```