What is the difference between OAuth 2.0 and OIDC?
Assesses fundamental understanding of Authentication & Authorization conventions, runtime behavior, and memory/performance considerations.
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
OAuth 2.0 is an authorization framework for delegated access. It lets a user grant a third-party application limited access to a resource without sharing the password, and the result is an access token used to call APIs. OAuth 2.0 does not define how to authenticate a user or how to convey their identity.
OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0. It adds an ID token (a JWT with standardized identity claims), a /userinfo endpoint, standardized scopes such as openid profile email, and a discovery document at /.well-known/openid-configuration.
OAuth 2.0: get an access token to call an API
OIDC: get an ID token that tells you who logged in
Use OIDC when you need "sign in with" behavior or federated identity. Use plain OAuth 2.0 for machine-to-machine API authorization. A frequent mistake is treating an OAuth access token as proof of user identity; that is what the ID token is for.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.