Himesh Siriwardana

When a user signs in to a React application using OpenID Connect (OIDC), the application typically receives an access token for calling APIs and an ID token containing information about the authenticated user. The ID token is returned as part of a successful OIDC flow when the application requests the openid scope.

If you followed the Authorization Code flow with PKCE, you would have seen these tokens in the token response.

It's not a secret that passwords are unsafe.

We ask users to invent a secret, remember it for years, never reuse it anywhere else, type it correctly on every device, and somehow keep it safe from attackers.

Introduction​

Every time a user clicks a "Sign In" button in your React app, it creates a small storm.

The browser jumps between URLs. Random-looking values appear in query parameters. Requests fly off to an identity provider. Tokens come back. And a few seconds later, your app somehow knows exactly who the user is.

With a modern SDK like the WSO2 Identity Platform React SDK, all of that sits behind a single <SignInButton /> component. This is exactly the point of SDKs. Every time you need authentication, you shouldn't have to rebuild an entire authentication protocol.