thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

ID Token

OIDC JSON Web Token that asserts the identity of the authenticated user to the client application.

Definition

The ID token contains claims such as iss (issuer), sub (subject), aud (audience), exp (expiry), iat, nonce, and authentication context. The client must validate its signature, issuer, audience, and expiration. It is meant for the client, not for calling APIs.

Example

A web app reads the email and name claims from the ID token after validating it with the IdP's published keys.

Exam tip

Don't send ID tokens to APIs; use access tokens for API authorization.

Related terms