OAuth and OIDC

OAuth is the standard that lets you give an app limited access to your account on another service without handing over your password, as when a calendar app asks to read your Google Calendar. You’re sent to Google to log in and approve, Google hands the app a short-lived authorisation code, and the app exchanges it for an access token that permits only what you agreed to. OAuth is about access, not identity, so OpenID Connect (OIDC) adds an ID token, usually a signed JWT, that says who you are, and that’s what powers “Sign in with Google”. Most real-world bugs are in the details, like skipping PKCE or accepting a token without properly checking its signature, issuer and audience.