> since OIDC is pretty complex in of itself Obviously this is subjective, but I actually disagree somewhat. Once you get down to actually writing the code to i

> since OIDC is pretty complex in of itself Obviously this is subjective, but I actually disagree somewhat. Once you get down to actually writing the code to implement OIDC, it's rather simple. But I feel like the specs make it look pretty scary. I think the confusing part for me was understanding why some parts of it seemed to have so much song and dance (ie the three legged authorization code flow, PKCE, etc). I find the best way to understand the complexity is by having it explained in the context of what attacks are mitigated by specific steps. For that, documents like https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics https://datatracker.ietf.org/doc/html/draft-ietf-oauth-secur... are much more useful.