It is a conflation of the access token (message to the protected resources about the client) and the identity token (message to the client about the user). OAu

It is a conflation of the access token (message to the protected resources about the client) and the identity token (message to the client about the user). OAuth doesn't define the concept of an identity token, hence it not being usable itself for authentication OpenID Connect extends OAuth with an identity token, which is of course readable by the client. To be fair, Facebook Connect explicitly made this choice to combine the identity token into the access token - so their access token is necessarily client-readable and verifiable.