The client sends an OAuth authorization request with scope=openid (plus profile, email), receives an authorization code, exchanges it for an ID token and access token, and validates the ID token (signature from the provider's JWKS, iss, aud, exp, nonce). Discovery (/.well-known/openid-configuration) publishes endpoints, supported algorithms and jwks_uri; dynamic registration and logout specifications cover the rest of the lifecycle.
The core specification was also published as an ISO/IEC standard (ISO/IEC 26131:2024). Related OpenID Foundation work includes the FAPI security profiles for open banking, OpenID Federation for trust chains, and OpenID for Verifiable Credentials (OpenID4VP and OpenID4VCI) used by digital identity wallets.
Typical bugs: skipping nonce or state, accepting tokens from any tenant of a multi-tenant provider, trusting the e-mail claim as an account key without email_verified and issuer checks, and using ID tokens as API access tokens.