141
OAuth and OIDC
OAuth delegates access. OIDC is login on top of it. The id token is not the access token.
What is OAuth and OIDC?
OAuth 2 is authorization: a token that lets you call an API. OpenID Connect adds an identity token that says who logged in. Mixing them — treating an access token as proof of identity, or skipping state/PKCE — is how login gets forged.
Why does OAuth and OIDC matter when vibe coding?
Models paste an OAuth tutorial that uses the implicit flow and skips `state`. Name the flow: authorization code with PKCE for public clients.
How do you do OAuth and OIDC?
Authorization code plus PKCE. Verify `state`. Validate the ID token’s issuer, audience, and signature. Store refresh tokens as secrets. Do not put tokens in URLs that get logged.
How do you ask a model for OAuth and OIDC?
Use OAuth authorization code with PKCE for (provider). Validate state. If this is login, validate the OIDC id token (issuer, audience, signature). Do not use the implicit flow. Do not treat the access token as identity.
What goes wrong with OAuth and OIDC?
Rolling your own parsing of the JWT without checking the signature. A JWT is a claim. The signature is why you believe it.