title: OpenID Connect - Implicit Flow with Javascript app using JWT to authenticate with a REST API
body: <p>I am developing a Javascript app + REST API.</p>
  
  <p>I want users to authenticate with the app (and underlying REST API) via an OpenID Connect Provider for SSO purposes.</p>
  
  <p>Using the Implicit flow I can get an ID token (JWT) identifying the user to my javascript app. I was hoping that I could then send this JWT in the Authorize header in requests to my REST API to authenticate the user. However, the problem with this approach is that the 'aud' field of the JWT won't be for the REST API server, it would be for the javascript app.</p>
  
  <p>Does this mean Implicit flow is not suitable for my use case, or am I missing something?</p>