What is a common mistake when working with OpenID Connect?

A common mistake with OpenID Connect is sending an ID token to an API as though it were a general-purpose access token confuses authentication and authorization responsibilities. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.