Glossary: Identity and Access Management

ID token

Also written: id_token

A signed JWT from OpenID Connect that says who signed in, meant for the client app itself. Its audience is the app (`orders`), so an API must refuse it.