ID tokens describe authentication context; access tokens authorize access to resources. Interchanging them without regard to purpose causes validation errors.
Evaluation approach
Each consumer validates expected issuer, audience, lifetime and signature. Readable content is not inherently trustworthy.
Application example
An API should reject the wrong token type even when supplied by a mobile client.
Limits and considerations
Two JWT-shaped values need not carry equivalent authority.
Is the displayed name trustworthy?
Complete required validation before using token fields. Even a verified name is not sufficient authorization for an API operation.
Checks and decisions
- Separate token purposes
- Check audience
- Verify signatures
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.