What are Authentication Flows Supported by Google OpenID Connect service?

Google OpenID Connect service supports 3 Authentication Flows:

1. Implicit Flow - The Implicit Flow is simple to implement. But it is less secure. Authentication is done in a single call to Google OpenID Connect service, which returns the "id_token" containing user identity.

2. Authorization Code Flow (Server Flow) - The Authorization Code Flow is more complex to implement. But it is more secure. Authentication is done in two calls to Google OpenID Connect service. The first call returns only an authorization "code". You need to make a second call to exchange "code" for the final "access token".

3. Hybrid Flow, also called OAuth 2.0 Multiple Response Type Encoding Practices - In the Hybrid Flow, you ask for both "id_token" and authorization "code" in the first call. This allows you to mix the Implicit Flow and Authorization Code Flow together.

 

⇒ Google OpenID Connect Metadata Document

⇐ Application Registration for Google OpenID

⇑ Google OpenID Connect Integration

⇑⇑ OpenID Tutorials