Nonce
A nonce is a value used for a particular protocol exchange to help distinguish that exchange from others and detect inappropriate reuse.
Connecting a response to a sign-in attempt
A nonce’s job depends on the protocol. In OpenID Connect, a client can send one with an authentication request. The identity provider puts it in the returned ID token, and the client compares it with the value expected for that sign-in attempt.
This binds the ID token to the client session and helps prevent replay. The requirements vary by flow, but OpenID Connect requires nonce values to be sufficiently unpredictable. Reusing one fixed value across attempts breaks that protection.
If an application starts sign-in attempt B and receives a token from attempt A, the nonce won’t match B’s stored value. The application rejects the response instead of creating a session from it.
An ID token nonce does not prevent reuse of a separately issued bearer access token if that token is stolen.
Nonce, state, and PKCE do different jobs
OAuth state connects a response to the client’s request and can support cross-site request forgery defenses. PKCE binds authorization-code redemption to a verifier held by the initiating client. Neither is another name for an ID token nonce.