I struggle to understand why don't we just have a single token that serves both purposes - authorisation and authentication?
In some sense, the access token does more than just authorisation. It also provides user id (in the sub claim) and after verification, the API (audience of the token) knows both - who you are and what you are allowed to do.
ID token, on the other hand, is meant for the client, but in case of a SPA, I don't really see any point in it at all. A SPA retrieves both tokens, ditches ID token and uses the access token to communicate with an API.
Some questions: - Is it purely because of historical reasons, that we are stuck with two separate tokens? - When do I really need the ID token? What does a SPA do with it?