Not an expert but from my understanding so far..
You need to validate both access and ID tokens to ensure that the claims in them are trustworthy. You can validate in any of these ways:
- Use symmetric key. In this case, the key should never reach the browser, and we need to be careful to only share with trusted entities.
- Use asymmetric key. In this case we can share the public key freely with any client, including the browser so they can verify the key locally. The key can be part of the front-end code of your app or simply be returned by an endpoint from your application.
- Use endpoint. OpenID Connect provides the access_token/introspect endpoint that let's us know if the access key is active. There is no standardized endpoint for the id token.
Now, in terms of validating the ID token, I think you shouldn't even request for it if you don't need it. That will make it also apparent if you need it or not. In practice, if you don't show any of the authenticated user's info in the interface (e.g. email, username, profile photo), you probably don't need it.