The OpenID Connect Standard

About this paper

OpenID Connect won its domain more completely than any standard in this series. Every “Sign in with Google,” every Entra login, billions of authentications a day.

And it appears as a declared security scheme in 102 of 14,195 published API contracts. 0.72%.

That is not a story about failure. It is a story about a seam: the identity layer and the API-contract layer barely overlap in practice, and OpenAPI’s openIdConnect scheme — which exists precisely to bridge them, and which hands any machine the issuer, endpoints, scopes and signing keys from a single line — is the least-used feature in its security vocabulary. Meanwhile 4,173 documents declare a bearer token, 815 put an API key in the query string, and the identity platforms doing the real work show up only as OAuth URLs. The full report has the whole security-scheme census, why the number is structural rather than negligent, the OpenID Foundation’s certification programme (the only working conformance machinery in this series), and what dual identity has to become before agents can act safely.

What's inside

1. Executive summary — 0.72%
2. What OpenID Connect is, and what it is not
3. The 0.72%, in context
4. Why the number is what it is
5. The body, and the thing it has that others do not
6. The blueprint — one line
7. The regulatory layer
8. Agents, delegation, and what identity has to become
9. The scoring caveat and the limits
10. What would have to be true
11. The investable thesis
12. Where this is going

What you get for $500.00