The phrase "verify identity claims" just means "authorize". There has never been a version of OAuth that would authenticate an identity. edit: Sorry, it's easy

The phrase "verify identity claims" just means "authorize". There has never been a version of OAuth that would authenticate an identity. edit: Sorry, it's easy to understand how "verify identity claim" does sound like authentication. What it means for OAuth, is that a system authorizes access based on delegated authentication. So "verifying an identity claim" is binding a local authorization event to a remote authentication event. Or something.