today we've had an interesting question over a coffee:

If I would implement my own client security for openID connect and use the authorization code grant - do I have to verify the ID-Token if I only use the access token?

The spec says "Clients MUST validate the ID Token in the Token Response ..." but does it make sense if I don't use it?


PS: no, I do not think about implementing my own security :-)

1 Answer 1


Not an expert but from my understanding so far..

You need to validate both access and ID tokens to ensure that the claims in them are trustworthy. You can validate in any of these ways:

  1. Use symmetric key. In this case, the key should never reach the browser, and we need to be careful to only share with trusted entities.
  2. Use asymmetric key. In this case we can share the public key freely with any client, including the browser so they can verify the key locally. The key can be part of the front-end code of your app or simply be returned by an endpoint from your application.
  3. Use endpoint. OpenID Connect provides the access_token/introspect endpoint that let's us know if the access key is active. There is no standardized endpoint for the id token.

Now, in terms of validating the ID token, I think you shouldn't even request for it if you don't need it. That will make it also apparent if you need it or not. In practice, if you don't show any of the authenticated user's info in the interface (e.g. email, username, profile photo), you probably don't need it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.