ID token
An ID token is an OpenID Connect security token containing claims about a user's authentication, issued for a client application to validate.
Reading the claims
An ID token is a JSON Web Token used in OpenID Connect. Its core fields tell the client:
iss: which provider issued it.sub: the user’s identifier at that issuer.aud: which client the token is intended for.exp: when it expires.
Treat sub together with iss when identifying an account. A subject identifier belongs to its issuer; it is not a global identifier across every provider. Email addresses and display names are not reliable replacements for that pair.
Reading these fields is only inspection. The client must perform the flow’s validation checks, including the expected issuer and audience, expiration, and applicable signature and nonce checks. Use an OpenID Connect library rather than treating a decoded JWT as proof of sign-in.
What it does not authorize
An ID token is intended for the client handling sign-in. It is not an API access credential. If the application calls an API, it uses an appropriate access token, which the API checks separately.
The application may also create its own session after sign-in. That session cookie is another credential with a different job; it is not the ID token under a different name.