Validation (OpenID Connect Core §3.1.3.7): verify the signature with a key from the provider's JWKS and the algorithm the client registered (RS256 by default); check that iss equals the provider's issuer, aud contains the client ID (and azp if several audiences), exp is in the future, and nonce matches the value the client sent; optionally check auth_time, acr and amr. The user's stable identifier is the pair of iss and sub, not the e-mail address.
An ID token is for the client, not for APIs: sending it as an access token to a resource server is a common anti-pattern because its audience is the client. Hybrid and implicit flows return ID tokens through the browser, which is why at_hash and c_hash exist to bind tokens together.