OpenID Connect
OIDC. Identity layer on OAuth 2.0. ID tokens for who the user is. Access tokens for APIs.
OpenID Connect sits on OAuth 2.0 and adds an ID token, usually a JWT, so a client can know who logged in, not just that an API call is authorised. Modern SaaS single sign-on is mostly OIDC, not SAML.
Treat access tokens as secrets. Validate issuer, audience, and expiry. Do not confuse holding a token with being allowed to do the thing. Prefer current libraries over home-parsed JWT. Pair with multi-factor authentication at the identity provider.
See also: SAML, Identity and access management, Multi-factor authentication, Authentication.