OpenID Connect OIDC
Identity layer on top of OAuth 2.0 — where OAuth grants access tokens, OIDC says who you are via a signed ID token (JWT).
Standardised by the OpenID Foundation in 2014. The ID token is a JWT containing user claims (sub, email, name). Discovery: /.well-known/openid-configuration makes auto-configuration trivial. Flows: Authorization Code + PKCE (recommended for SPAs and mobile), Hybrid, Device Code (CLI/TV). Powers "Sign in with Google/Apple/Microsoft". Federation builders: ADFS, Keycloak, Auth0, Okta. Every modern SSO implementation is built on OIDC.