Id tokens vs access tokens

user_7727201 0
Viewed 893

Auth0 claim I should ALWAYS use an access token to secure an API.

If I have control over both my client app and my backend API - why is it wrong to validate the id token as my authorization for my API? Id tokens signed with asymmetric keys seems secure - I don't understand how this is less secure than an access token.

jwt oauth-2.0 google-oauth authorization authentication
1 Answers

It is not so much about security more more about usability and semantics. An id_token is supposed to represent an authentication event: it is short-lived and (primarily) designed to be one-time usage only, Those properties don't make it a good token for API usage.

user_37483490
Related