What is the difference between OAuth 2.0 and OpenID Connect?

Question

Accepted Answer

**OAuth 2.0** — authorization framework. **OpenID Connect** — authentication layer on top.

**OAuth 2.0:**
- Authorization only.
- Grants access to resources.
- Access tokens.
- "What can I access?"

```
OAuth 2.0:
User → Authorize App → Access Token
App uses token to access API
(Grants access)
```

**OpenID Connect:**
- Authentication + Authorization.
- Verifies user identity.
- ID tokens (JWT).
- "Who are you?"

```
OpenID Connect:
User → Login → ID Token (user info)
+ Access Token (API access)
(Verifies identity + grants access)
```

**Key differences:**
- **OAuth 2.0** — authorization.
- **OIDC** — authentication + authorization.
- **OAuth** — access tokens.
- **OIDC** — ID tokens + access tokens.

Systems Analyst: What is the difference between OAuth 2.0 and OpenID Connect?