Web Security · Middle · Question 53 of 75

What is the difference between an OIDC ID token and an OAuth access token?

1The ID token is for APIs, the access token is for the client
2They are the same token with different names
✓Correct answer: The ID token tells the client who the user is; the access token is presented to APIs to access resources

Explanation

APIs shouldn't accept ID tokens as access tokens: the audience is the client, not the API.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.