OpenID Connect (OIDC)
OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that lets applications verify who a user is. Alongside an access token, the identity provider issues a signed ID token, a JWT containing claims such as the user ID, email, and authentication time.
Technical Architecture & Deep-Dive
OAuth answers what an app may access, while OIDC answers who the user is. Providers like Google, Microsoft, Auth0, Clerk, and Firebase implement OIDC, publishing discovery documents and signing keys so any application can validate their ID tokens.
Edge gateways can verify OIDC tokens on every request by checking signatures against the provider public keys, rejecting unauthenticated traffic before it reaches upstream APIs.
Key Architectural Benefits
Implement OpenID Connect (OIDC) at the Edge
Deploy lightweight API aggregation, edge caching, and secret injection in minutes without Docker containers or complex servers.
Frequently Asked Questions
Q:What is the difference between an ID token and an access token?
An ID token proves user identity to the client application. An access token authorizes calls to an API and should be validated by that API.
Related Architecture Concepts
OAuth 2.0 is an authorization framework that lets an application obtain limited access to a user account on another service without handling the user password. The user approves requested scopes, and the application receives an access token it uses to call the service API.
A JSON Web Token (JWT) is a compact, URL-safe token containing a JSON payload of claims, such as user ID and expiration, signed by the issuer. Servers verify the signature to trust the claims without a database lookup, enabling stateless authentication.
PKCE, short for Proof Key for Code Exchange, is an OAuth 2.0 extension that protects the authorization code flow for public clients like mobile apps and single-page applications. The client sends a hashed code challenge, then proves possession of the original verifier when exchanging the code for tokens.
Ready-to-Use Edge Recipes
To combine firebase auth user with supabase profile endpoint, use one RealComposer pipeline with parallel steps. Firebase ID token lookup and Supabase profile row merged at edge. Your React / Flutter / Mobile app makes one request instead of several sequential upstream calls.
To stitch firebase with clerk session bootstrap, use one RealComposer pipeline with parallel steps. Clerk session and Firebase FCM registration merged at startup. Your React Native app makes one request instead of several sequential upstream calls.