OAuth 2.0 and OpenID Connect: What "Sign in with Google" Actually Does

OAuth 2.0 replaced handing your password to a third party with delegated authorization: the app gets a limited, revocable token and never touches your credentials. Four roles are involved, the resource owner, the client, the authorization server, and the resource server.

The distinction people get wrong is that OAuth answers what an app is allowed to do, not who the user is. OpenID Connect adds that identity layer, returning an ID token (always a JWT) alongside the access token. In the authorization code flow, the client redirects to the authorization server, gets back a short-lived code through the browser, then exchanges it server-to-server for tokens, which is what keeps the access token out of URLs and browser history. Access tokens go to APIs and should be treated as opaque; ID tokens are for the client to validate and read.

Always use PKCE, validate state and nonce, and skip the deprecated implicit flow.