An identity layer built on top of OAuth 2.0 that confirms who a user is, not just what they're allowed to access.