ID Tokens VS Access Tokens: What's the Difference?

ID Tokens vs Access Tokens. What are they and when do you use them? How do they differ? Where do they come from? We'll briefly cover OAuth 2.0 and OpenID Connect and the difference between Authentication and Authorization.
Grab the FREE Cheat Sheet from the Auth0 by Okta blog post -
auth0.com/blog/id-token-acces...
Sign up for our monthly newsletter! a0.to/zeroindex
#authentication #developer #tokens #login
___________________________________________
Learn with Auth0 by Okta
Try for free - a0.to/auth0
The Auth0 by Okta blog - a0.to/blog
Ask questions on the Community Forum - a0.to/community ___________________________________________
Follow Us on Social
Twitter - / oktadev
LinkedIn - / oktadev

[@meetzaveri734]

I was dumbly sweating off for 2 days trying to get user information from an "access token" but then I saw this video. The clear difference you explained makes so much sense. Thank you for developing this content, auth0.

[@cantucodes]

Great video! I especially enjoyed the illustrations created!

[@michaelmendoza9824]

Super informative and concise. Excellent! MM

[@dileepsoundar1590]

the differences were explained very nicely!

[@Fshhady]

Thanks James. Great content as usual. I am a big fan.

[@OktaDev]

Glad you enjoy it!

[@_just_for_fun_4472]

wow that was a super delicious explanation!! Loved it!!

[@paulr9572]

Great video. Very clear. Thank you!

[@dariuszglowacki8356]

You have made it to the point! This is an amazingly easly understandable content in the bushes of misinformation on the internet on that subject! You are explaing here much more than just a difference between the tokens! Well done!

[@shubhang93]

@OktaDev 1:42 "JAWT" is a shortened form of "JAson Web Token"

[@user-zz6fk8bc8u]

"JAWT" and "JOT" are only spoken. It's just the way some people pronounce "JWT" because "jay-double-you-tea" is pretty long.

[@prashant9065]

Great video compact and informative

[@fieryscorpion]

That was very nicely explained. Thank you!

[@vidyapai6990]

Thanks for a simple and clear explaination

[@gurelbenshabat]

Nice one 🎉 informative and helpful 👍

[@ravikanthgande8860]

Nicely presented, thank you

[@maverick173]

Thanks James! You rock.

[@umaodihirin5879]

This video is a gem. Thank you so much! 💎

[@GruffGuy]

Great explaination. Saved

[@user-mg7fc5yu6y]

Awesome content!! Thanks a lot 🙌🏾❤

[@sehgalomar]

Fantastic video. Very thorough and at the same time concise.

[@OktaDev]

Great to hear, thanks for the feedback!

[@Folderq]

Well explained. Thank you

[@user-ip2nr3cq8b]

Great explanation, thank you

[@OktaDev]

You are welcome! James is great at explaining things!

[@amjedbouhouch7993]

Thank you James! I have some questions What is the use case to have a decentralized authentication or is it preferable ? And for the OAuth protocol I think the use case for the apps that allows integrations and exposes the API to the public ? Or the use case can be suitable for a single app that have micro-services, and multiple clients like web, mobile apps ?

[@Hybrid_Netowrks]

Awesome, Thank you so much boss

[@jesprotech]

I love this video. Very well made, the music and the animations are a great match. I think I know a few people that have or are using access tokens as a form of ID. This is a nuance that I only became aware after watching this video, so I definitely learned something new here. Thanks for making this video!

[@navinrangar2626]

thanks man

[@KhodeCamp]

Finally I understand ID token and Access token. Thank you so much sir!

[@alejandrombc]

Thanks for the awesome video!, but I have a question, what if the APIs are like a BFF (APIs that are tied specifically to your web/app)?, in that case can be "good" to use the ID token as a Bearer?. If we need to just sent the access token, how can we use custom attributes (or validate custom permissions) if the information is not available in the token itself without continuously fetching and validating the data?. Thanks!

[@liferajib]

@Alejandrombc did you get an response ? We are in same boat

[@Daniel-zl7wf]

Great explanation on the difference between access and id tokens. I have a question about access tokens in Auth0 (since as of now there is no agreed upon specification) How does the api receiving the access token know who the requester is (username/email)? The access token proves the user is authorized to request a resource, but has no information who the user is. So how could a remote api determine someones identity information without using the identity token?

[@Daniel-zl7wf]

Attempting to answer my own question after some research: "The access token is not intended to carry the user data (except for ID passed as the sub claim)" So the remote api can use the "sub" field in the access token to query user data from auth0 such as email.

[@codewithray]

@@Daniel-zl7wf Thanks bro. Very Informative 🙌

[@randomhandle307]

I've had the same question.

[@Daniel-zl7wf]

@@randomhandle307 What I've ended up using the sub field id within my own database as a userId. Not sure if this is the best way.

[@vivekagrawal5608]

I don't know about Facebook or Google. However, in my org, we are using access token to get the clientId, scope and user info as well. Its called 3LO token.

[@adysong8086]

Can we send Id token to backend for getting the user's data? Note: Sending acces token for api authorisation as well

[@pushpeshkumar4656]

Awesome video

[@danilomourelle]

If id token is for bring user info in payload, why does it need to be JWT? What situation I would validate signature if it came from a redirect from IdP?

[@sidcastilho1]

Great video.

[@sabuein]

Thank you.

[@OktaDev]

You got it!

[@user-ed8ou2fk5e]

i am very confused the role of id_token, after the application request to authentication server, the server will return id_token, access_token。in my opinion, application request the backend api will pass id_token to backend sever, and backend will use id_token to judge the user is logged? but according the video, id_token is not passed to api. so id_token returned only tell the application the user is logged a moment? id_token will no any effect when api calling？

[@BerniesBastelBude]

well explained - thx!

[@OktaDev]

thanks for watching!

[@matthayden1979]

Great explanation! However, I have a query here. In an enterprise app, the user is authenticated at the frontend app (built in react, angular, etc.) and have the access to ID token, which would be user for future authentication. Now the frontend app needs to access protected RESTful API endpoint. So, authorization will be implemented using the same Identity server (which will act as Authorization Server)? So, for an enterprise app, authentication and authorization can be done using same Identity Server?

[@andrea.chiarelli-okta]

Assuming that the Identity provider (IdP) uses OpenID Connect, the answer is yes. OpenID Connect is built on top of OAuth 2.0, so the same server is both an Identity provider and an authorization server. Your frontend app can request both an ID token and an access token

[@matthayden1979]

@@andrea.chiarelli-okta So, what if OIDC is not used for authentication? Some other protocol/framework being used?

[@andrea.chiarelli-okta]

@@matthayden1979 SAML is another protocol. It relies on exchanging XML documents (SAML Assertions) instead of tokens

[@CortezLabs]

Thank you

[@ianokay]

Just because an access token doesn't guarantee that a user is logged in does not, at all, seem to mean that we can't presume the user is authentic. They certainly did make authenticity clear in granting the resource access, so it does absolutely seem to be an authentication token. The only things that make it an authorization token, is if scopes are stored (and checked) associated with that token on the resource server. However, it's certainly also a claim of authenticity if it contains authentic claims for authorization. 😑🤨🤔

[@georgesmith9178]

Awesome. Thumbs up of course. I am just curious if there is a tool that I can use to decode an ID token in code, preferably a command line utility like jq but for ID tokens?

[@OktaDev]

We'd recommend checking out github.com/jwt-rs/jwt-ui You can encode and decode JWT ID tokens and access tokens using JWT UI on the CLI. Hope that helps!

[@mrgilbe1]

I have a dumb question. If an access token provides authorization but not authentication, how in the example does Twitter know what user they are posting as? Seems that there MUST be at least an implicit authentication here?

[@srk--I]

JWT is for Authorization

[@Shinee3e]

You are just awesome ❤

[@user-rd4oo1jg5g]

Hello, how are you, there are applications that request a token, request that the client id and seceret key be sent, others an api token and a secret key, how is this different from, for example, sending user and pass?

[@andrea.chiarelli-okta]

Client IDs and secret keys or API keys and secret keys are credentials for an application, that is, they identify the application, not the user. You can think of them as usernames and passwords, but just for the applications. An ID token simply tells an application that the user has been authenticated. An access token allows an application to access a resource on behalf of a user without using the user's username and password. So, both ID tokens and access tokens don't identify an application, while client IDs/API keys + secret keys do.

[@user-rd4oo1jg5g]

@@andrea.chiarelli-okta Thanks for all! for example when I have 2 internal applications that connect through an api or an internal application with an external one but I always use the same user to authenticate, would I use client and secret to be able to generate and use the token?

[@jeraldjee5693]

Nice, One question - Can we add new claim to access token after logged in?

[@mraible]

No. The only time you can enrich an access token is upon login. However, you can add an API with a token lifetime of 30 seconds. Then, pass in `offline_access` as a scope, and you should get a new access token (with updates from actions, and therefore enriched) every 30 seconds. This depends on your SDK. It works with the Okta Spring Boot starter.

[@alexanderpanfilenok6818]

If you send an access_token to the API how the API knows that it is allowed to do something on behalf of Jone Doe? There is nothing related to John Doe in the token itself

[@johnmathew3423]

Please try on behalf flow

[@rayn1ful]

tokens are something i used at chucky cheese when i was a kid to play games. what does a token have to do with a computer or the internet? lots of people out there do not like 2fa.

[@FolkOverplay]

If the access token shouldn’t be sent to my API from my front end, how can my backend know that the user is logged in? Sure, the frontend knows but if it can’t ever convey that information to the backend when making requests, what is it good for? I’m probably missing something obvious but I’m honestly confused.

[@andrea.chiarelli-okta]

I assume you mean the ID token, not the access token. Your ID token should not be used to tell your backend that the user is logged in (i.e., to create sessions). It's just a confirmation to your frontend app from the authorization server that the user has been authenticated. Your application is responsible for creating its own session using the appropriate technique. For example, in a Web application, you can rely on traditional cookies to create sessions. In a mobile application, you can use session tokens. ID tokens don't replace the way you create and manage your own sessions I hope this clarifies

[@FolkOverplay]

@@andrea.chiarelli-okta thank you for your reply. Yes I did mean the ID Token. I think I probably need to read up more on this. I fail to see the benefit an ID Token offer except displaying email, name, etc. in the frontend if I can’t send it to my backend. Is this understanding correct? I currently store the ID token in memory only and not in local storage or cookie (Web App). I do send it to my backend. Is this completely wrong?

[@OktaDev]

Thanks for your reply, Andrea! :)

[@andrewgoss6486]

JWT sounds like "Jawt". I call them JWT "jawt" tokens because that is what I see when I see the three letters.

[@Vmr48765]

Ok so what token can be sent to API if not ID token and auth token?

[@mraible]

It should be an access token. When you use authorization code flow with OpenID Connect, you'll get both an ID token and access token.

[@EgorLazeba]

I love you, man

[@yordanov5.0]

If ID tokens(JWT) should never be sent to an API, then how the hell a client can be authenticated ? Why Spring Boot has inbuilt methods and structure for signing and validating JWT if we are not going to sent JWTs to Spring Boot API ? Am I wrong or everywhere I read (Stackoverflow, tutorials , etc..) it said exactly the opposite of your statement ?

[@mraible]

The tokens that Spring Boot validates are access tokens, not ID tokens. If you try to send an ID token to a Spring Boot backend, it won't work. Spring Boot also supports validating opaque access tokens (that are not JWTs) via the introspection endpoint.

[@bhanusivasri]

❤

[@wolfoo2931]

"ID Tokens should NOT be sent to an API" is still confusing for me. I guess in most cases you want a single sign on in your web application, so you do not have to deal with the user managemnet yourself. Now probably your web application consists of a frontend (let's say a SPA) and one (or more) backend. In this case, are the frontend and the backend different clients, with different client ids? Now, in the backend of my web app, I need to identify the user because it is my backend which has to do the authorization (in most of the cases checking the userid (sub) against an access control list). But apprently I can not use the id token for that purpose? Looking at a how-to from google-developes this seems to be the way to go: kzbin.info/www/bejne/oJCWYpuAqbydotk ... What is your preferred way of identifying an user in the backend? Using the backend's client_secret to introspect the id token, or use the access token to call the userinfo endpoint of the ID provider?

[@mraible]

There are two techniques I recommend for solving this problem: 1) add additional claims with identity information to your access tokens or 2) call the /userinfo endpoint on the backend with the access token to get identity info. If you do #2, you'll probably want to cache lookups for scalability.

[@esparda07]

"...maybe not that stressful..." Sir, it definitely is. xD

[@ankittiwari6902]

Thanks for the video, is it possible to get the access token when the scope is set to openid? If yes, flow used in OAuth2.0 can be followed in Openid as well?

[@zea7452]

Can somebody explain to me about accesstoken more clearly???? 😅

[@aaronpk]

Check out this video! kzbin.info/www/bejne/eH-ooH6brdGgd5Y

[@T25de]

I miss the dislike counts being visible, KZbin fucked users and creators. I’m sure this video has so little dislikes, a shame not to display the winning ratio

[@futhedude4848]

recap: ID token is the token return from JWT, Access token is the token return from Oauth2

[@vipinkoul595]

What is Identify provider? When we initially login / authenticate (a user) , is it against the Identify provider? Does identify provider provide the ID Token?

[@mraible]

The identity provider is the one that provides the authorization server. For example, Google is an identity provider, as is Okta and Auth0. When you initially authenticate, you do that with the authorization server and it provides the ID token.