ID Token and Access Token: What’s the Difference?


  • What Is an ID Token?
  • What Is an Access Token?
  • What Is an ID Token NOT Suitable For?
  • What Is an Access Token NOT Suitable For?
  • A Quick Recap
Have you ever made similar arguments? Choosing based on your intuition may sound good, but what seems intuitive isn't always right. In the case of ID and access tokens, they have clear and well-defined purposes, so you should use them accordingly. Using the wrong token could make your solution insecure.

“What changes in the end? These are just tokens. I can use them as I please. What's the worst that can happen?"

Let's take a closer look at these two types of tokens to better understand their role in the authentication and authorization processes.

What Is an ID Token?

An ID token is an artifact that proves that the user has been authenticated. It was introduced by OpenID Connect (OIDC), an open standard for authentication used by many identity providers such as Google, Facebook etc.
Let’s take a quick look at the problem OIDC wants to resolve.

Consider the following diagram:

Here, a user with their browser authenticates against an OpenID provider and gets access to a web application. The result of that authentication process based on OpenID Connect is the ID token, which is passed to the application as proof that the user has been authenticated.

This provides a very basic idea of what an ID token is: proof of the user’s authentication. Let’s see some other details.
An ID token is encoded as a JSON Web Token (JWT), a standard format that allows your application to easily inspect its content, and make sure it comes from the expected issuer and that no one else changed it. If you want to learn more about JWTs, check out The JWT Handbook.

To put it simply, an example of ID token looks like this:


Of course, this isn’t readable to the human eye, so you have to decode it to see what content the JWT holds. By the way, the ID token is not encrypted but just Base 64 encoded. You can use one of the many available libraries to decode it, or you can examine it yourself with the debugger.

"iss": "",
"sub": "hamrosaathi|123456",
"aud": "1234abcdef",
"exp": 1311281970,
"iat": 1311280970,
"name": "Bikky Singh",
"given_name": "Bikky",
"family_name": "Singh"

Related Post

How to become a Data Analyst and Complete Roa

A data analyst's responsibilities include conducting a ...

What you know about Application Programming I

API: API is the acronym for Application Programmin...

SpaceX vs NASA: Who Will Win the Space Race?

SpaceX and NASA are two of the biggest names in space e...

Leave a Comment

Share via

You cannot copy content of this page