OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0, maintained by the OpenID Foundation. It lets clients verify a user’s identity based on the authentication performed by an authorization server and obtain basic profile information, using signed ID Tokens in a standardized, interoperable way. It is the identity foundation of open banking and open finance ecosystems, where it underpins the FAPI security profiles.
OpenID Connect
OpenID Connect (OIDC) is the identity layer on top of OAuth 2.0. Where OAuth answers what can this client access, OIDC answers who is the user — verifying identity based on the authentication the authorization server performs and returning it in a signed, verifiable ID Token.
- ID Tokens - A signed JWT asserting the user’s identity and the context of their authentication, which any relying party can validate.
- Standardized flows and claims - Interoperable
authorization_codeand other flows, plus a standard set of identity claims, so identity works the same way across providers. - The base for FAPI - The Financial-grade API security profiles are built on OIDC, so regulated ecosystems — open banking, open finance, Australia’s CDR — inherit OIDC as the identity floor beneath their consent and authorization models.
In the sectors I score, OIDC alongside OAuth 2.0, FAPI, PAR, private_key_jwt, and mTLS is the mark of a genuine bank-grade authentication stack — a materially stronger baseline than the query-string API keys that still dominate most of the API economy.
Referenced on the API Evangelist blog
Where this standard shows up across sixteen years of my writing at apievangelist.com — how it fits into API design, governance, and the agentic turn.
API Governance Rules from the Netherlands
2025-05-05
