OAuth 2.0 vs OpenID Connect: What's the Difference and Which Do You Need?

Have you ever sat down to add "Sign in with Google" to an app, started reading about OAuth, and then half an hour later found yourself reading about something called OpenID Connect, wondering if you're in the right place? The two get mentioned together so often that it's easy to assume they're the same thing, or that they're competing options. They're not, but picking the wrong one (or using one when you actually needed both) is one of the most common mistakes I see in real-world projects. In my previous posts I walked through using OAuth 2.0 with C# and using OAuth 2.0 with Node.js. Both of those were about getting an access token so an app could call an API. This time, I want to step back and answer the question that comes up right afterwards: where does OpenID Connect fit in, and do you need it? On this page The short answer A hotel analogy What OAuth 2.0 actually does What OpenID Connect adds Access tokens vs ID tokens What it looks like in practice Which one do you need? Common…