Show me your access token, and I will tell you who you are, or at least obtain a lot of valuable information. ID tokens, in line with the OpenID Connect specification, are always in the form of a JSON Web Token (JWT).

Read full article on The New Stack