Authentication vs Authorization: Two Tokens
OpenID Connect (OIDC) layers authentication (proving who you are) on top of OAuth 2.0's authorization model (proving what you can do). The ID token is a signed claim that the user is authenticated and optionally contains claims about them (name, email, roles). The access token is an opaque credential that grants the app permission to call specific APIs or resources.
The ID token is for the app itself: it proves identity to the login form. The access token is for backend services: it proves the app has permission to request user data or perform actions. They have different audiences, different lifetimes, and different purposes.
Lifetime and Trust
ID tokens are typically short-lived (15 minutes to 1 hour), because they contain identity claims that should be fresh. If a token is stolen, it expires quickly, limiting the window of compromise. Access tokens can have longer lifetimes (hours to days) because they are opaque and revokable on the backend, not tied to specific claims about the user.
A compromised access token allows an attacker to call APIs; a compromised ID token allows them to impersonate a user in the login context. The distinction lets systems design different rotation and revocation strategies: ID tokens are refreshed more frequently, access tokens are stored more securely (httpOnly cookies, in-memory storage).