1

Whereas OAuth2 doesn't explicitly define which token type to use, OpenID Connect defines an API and data format to perform OAuth2 authorization flows.

What are the occasions in which a JWT is returned in OpenID Connect?

Improve this question

1 Answer 1

Reset to default
2

Authorization flow: the client requests an authorization code to the authorization endpoint (/authorize). This code can be used againt the token endpoint (/token) to request an ID token (in JWT format), an access token or a refresh token.

Implicit flow: the client requests tokens directly from the authorization endpoint (/authorize). The tokens are specified in the request. If an ID token is requested, is is returned in JWT format.

Hybrid flow: the client requests both an authorization code and certain tokens from the authorization endpoint (/authorize). If an ID token is requested, it is returned in JWT format. If an ID token is not requested at this step, it may later by requested directly from the token endpoint (/token).

Source: Sebastián E. Peyrott, Auth0 Inc. The JWT Handbook (Kindle Locations 262-269). Kindle Edition.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .