Comparison
OAuth 2.0vsOpenID Connect
OAuth 2.0
the user grants your app access to their data on another service without ever giving you their password.
A delegated authorisation framework: a resource owner authorises a client to access an API on their behalf, and the client receives a token rather than credentials. It is authorisation, not authentication — the token says what you may do, not who you are. Using it for login is what OpenID Connect exists to fix.
Full entry →OpenID Connect
you use the identity provider to actually log the user in and get a verified claim about who they are, not just an access token.
An authentication layer on top of OAuth 2.0 that adds a signed ID token containing verified identity claims. It exists because OAuth alone conveys no trustworthy statement about the user, and every home-grown "login with OAuth" implementation reinvented it badly. If you want single sign-on, this is the protocol, not plain OAuth.
Full entry →