> ## Documentation Index
> Fetch the complete documentation index at: https://docs.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenID Connect

OpenID Connect (OIDC) is an identity and authentication layer that extends the OAuth 2.0 protocol. OAuth 2.0 involves the use of access tokens to enable access to or perform actions against resources across separate systems; while OIDC enables a client to access details about the users, and standardizes how an Identity Provider (IdP) brokers authentication across multiple services.

| Context: Why OIDC was introduced? |
| - |
| Prior to the advent of OIDC, service providers leveraged the OAuth 2.0 framework to access user information on resource servers, and to authenticate those users. However, they did so in their own idiosyncratic ways outside the scope of the OAuth. OIDC also establishes a proper standard that makes SSO and identity federation more universally understood. |

OIDC introduces the following concepts to the OAuth framework:

* **ID Token** - New token type a client can request and then exchange for information about the users.
* **UserInfo Endpoint** - API implemented by the authZ server. Allows a client to request user data.
* **Claims** - Name/value pairs of user data that the client requests. For example, an users's first name.
* **Standard Scopes** - Known scope identifiers that map to the pieces of user data a client can request.

Additionally, although the actors remain the same, OIDC renames a few OAuth terms to expand their role:

* The **Resource Owner** is now called the **Subject**. This is the users who owns their data in the IdP's server.
* The **Authorization Server** (which, in the identify domain, is an **authentication** server) is called the **Issuer**.
* The client is called the **Relying Party** (RP). It relies on the issuer to identify the users and issue tokens.

  **Note:** When you register a client with Storefront Gateway, it is registered as a Relying Party (RP). When the RP makes requests to Storefront Gateway, it needs to leverage our OIDC-specific API. The API will respond to your client based on the Authorization Grant Type and other settings that are configured for that Relying Party.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.