ID Token - Interview Questions & Answers

The ID Token is one of the most important concepts in OpenID Connect (OIDC).

Unlike an Access Token, which is used to access APIs, an ID Token is used to identify the authenticated user.

It is issued by the Identity Provider (IdP) after successful authentication and is almost always represented as a JWT (JSON Web Token).

---

Q1. What is an ID Token?

Answer

An ID Token is a JWT issued by an OpenID Connect Identity Provider after successful user authentication.

It contains information about:

• Authenticated User
• Authentication Time
• Identity Provider
• Client Application
• Token Expiration

The client application uses the ID Token to verify the user's identity.

ID Token Flow

flowchart LR

User --> IdentityProvider

IdentityProvider --> IDToken

IDToken --> ClientApplication

ClientApplication --> UserAuthenticated

---

Q2. Why do we need an ID Token?

Answer

OAuth2 only tells an application what it can access.

OIDC introduces the ID Token so the application can know who the authenticated user is.

Without an ID Token:

• Client cannot verify user identity.
• Authentication becomes provider-specific.
• Standard SSO becomes difficult.

Authentication Process

flowchart TD

User --> Login

Login --> IdentityProvider

IdentityProvider --> IDToken

IDToken --> ClientApplication

---

Q3. What is the difference between an ID Token and an Access Token?

Answer

ID Token	Access Token
Authentication	Authorization
Used by Client	Used by Resource Server
Contains User Identity	Grants API Access
OIDC	OAuth2

Comparison

flowchart LR

IdentityProvider --> IDToken --> Client

IdentityProvider --> AccessToken --> ResourceServer

Interview Tip

• ID Token → Who are you?
• Access Token → What can you access?

---

Q4. What information does an ID Token contain?

Answer

An ID Token contains standard claims defined by OpenID Connect.

Common claims include:

• sub (Subject)
• iss (Issuer)
• aud (Audience)
• exp (Expiration)
• iat (Issued At)
• auth_time
• nonce
• email
• name

ID Token Structure

flowchart TD

IDToken --> Header

IDToken --> Payload

IDToken --> Signature

Payload --> StandardClaims

---

Q5. What is the structure of an ID Token?

Answer

Since an ID Token is usually a JWT, it consists of three parts:

• Header
• Payload
• Signature

JWT Structure

flowchart LR

Header --> Payload --> Signature

Example:

xxxxx.yyyyy.zzzzz

Purpose

• Header → Algorithm
• Payload → User Claims
• Signature → Token Integrity

---

Q6. How is an ID Token validated?

Answer

Before trusting an ID Token, the client application should validate:

• Signature
• Issuer (iss)
• Audience (aud)
• Expiration (exp)
• Issued At (iat)
• Nonce (if used)

Validation Flow

flowchart TD

IncomingIDToken --> ValidateSignature --> ValidateIssuer --> ValidateAudience --> ValidateExpiration --> AuthenticateUser

If any validation fails, authentication must be rejected.

---

Q7. What is the sub claim in an ID Token?

Answer

The sub (Subject) claim uniquely identifies the authenticated user.

Example:

{
  "sub": "123456789"
}

Characteristics:

• Unique
• Stable
• Never reused
• Primary user identifier

Subject Claim

flowchart LR

IDToken --> Payload --> subClaim --> UniqueUser

---

Q8. What are common mistakes when using ID Tokens?

Answer

Common mistakes include:

• Using ID Token to call APIs
• Skipping signature validation
• Ignoring expiration
• Ignoring issuer validation
• Trusting unsigned tokens
• Logging sensitive token contents
• Sending ID Tokens to Resource Servers

Wrong Design

ID Token

↓

REST API ❌

Correct Design

ID Token

↓

Client Authentication ✅

Access Token

↓

REST API ✅

---

Q9. How does Spring Security use ID Tokens?

Answer

Spring Security automatically validates ID Tokens when OpenID Connect is configured.

Typical flow:

flowchart TD

User --> SpringSecurity

SpringSecurity --> IdentityProvider

IdentityProvider --> IDToken

SpringSecurity --> ValidateIDToken

ValidateIDToken --> AuthenticatedUser

Popular Identity Providers:

• Keycloak
• Okta
• Auth0
• Microsoft Entra ID
• Google Identity
• Amazon Cognito

---

Q10. What are the enterprise best practices for ID Tokens?

Answer

Follow these best practices:

• Always validate the signature.
• Validate issuer (iss).
• Validate audience (aud).
• Validate expiration (exp).
• Validate nonce (when applicable).
• Never use an ID Token for API authorization.
• Keep ID Tokens short-lived.
• Always use HTTPS.
• Do not expose tokens in logs.
• Use OpenID Connect with OAuth2 Authorization Code Flow.

Enterprise Authentication Architecture

flowchart TD

User --> IdentityProvider

IdentityProvider --> IDToken

IdentityProvider --> AccessToken

IDToken --> SpringBootClient

AccessToken --> ApiGateway["API Gateway"]

ApiGateway["API Gateway"] --> SpringBootAPIs

ID Token Lifecycle

flowchart LR

Authenticate --> GenerateIDToken --> ValidateIDToken --> CreateUserSession --> ApplicationAccess

ID Token Overview

mindmap
  root((ID Token))
    Authentication
    JWT
    User Identity
    Claims
    Signature
    Issuer
    Audience
    Spring Security

Senior Interview Tip

A common interview question is:

Can an ID Token be used to call REST APIs?

Answer: No.

• ID Token → Identifies the authenticated user.
• Access Token → Authorizes access to protected APIs.

A production-ready enterprise solution combines:

• OpenID Connect
• OAuth2 Authorization Code Flow
• JWT ID Tokens
• JWT Access Tokens
• Spring Security
• API Gateway
• MFA
• mTLS
• Zero Trust Architecture

---

Quick Revision

• ID Token is part of OpenID Connect.
• It identifies the authenticated user.
• It is usually a JWT.
• Validate signature, issuer, audience, and expiration.
• The sub claim uniquely identifies the user.
• ID Tokens are used by client applications.
• Resource Servers should use Access Tokens instead.
• Never use an ID Token for API authorization.
• Protect all token exchanges with HTTPS.
• Combine OIDC, OAuth2, JWT, and Spring Security for secure enterprise authentication.