AM & Access

ID Token

A signed JWT, issued by an OIDC provider, that carries claims about who the user is — the piece OAuth never had and OIDC exists to add.

An ID token is meant to be consumed once by the client that requested it, not passed around as a bearer credential the way an access token is — it proves who authenticated at a point in time, not standing permission to keep acting. Confusing the two is the same mistake OIDC was invented to stop people from making with raw OAuth tokens.