OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0, maintained by the OpenID Foundation. It lets clients verify a user's identity based on the authentication performed by an authorization server and obtain basic profile information, using signed ID Tokens in a standardized, interoperable way. It is the identity foundation of open banking and open finance ecosystems, where it underpins the FAPI security profiles.
OpenID Connect
OpenID Connect (OIDC) is the identity layer on top of OAuth 2.0. Where OAuth answers what can this client access, OIDC answers who is the user — verifying identity based on the authentication the authorization server performs and returning it in a signed, verifiable ID Token.
- ID Tokens - A signed JWT asserting the user’s identity and the context of their authentication, which any relying party can validate.
- Standardized flows and claims - Interoperable
authorization_codeand other flows, plus a standard set of identity claims, so identity works the same way across providers. - The base for FAPI - The Financial-grade API security profiles are built on OIDC, so regulated ecosystems — open banking, open finance, Australia’s CDR — inherit OIDC as the identity floor beneath their consent and authorization models.
In the sectors I score, OIDC alongside OAuth 2.0, FAPI, PAR, private_key_jwt, and mTLS is the mark of a genuine bank-grade authentication stack — a materially stronger baseline than the query-string API keys that still dominate most of the API economy.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The State of Telecom APIs
Where OIDC discovery is served at all it is often at a non-standard prefix no automated client will find by convention.
The State of US Insurance APIs
Anonymous OIDC discovery is where American insurance's only real scope catalogue leaks out — thirty-three product scopes, published by accident.
The State of Australian Banking APIs
OIDC underpins the consent-scoped identity model every CDR bank implements.
Referenced on the API Evangelist blog
Where this standard shows up across sixteen years of my writing at apievangelist.com — how it fits into API design, governance, and the agentic turn.
API Governance Rules from the Netherlands
2025-05-05
