`bojanz` I completely agree.  It seems silly.  In addition, I believe an access token (or at least the access token hash) is returned inside the `id_token`.  I looked through the spec, and saw *no justification* for these return types, only that they were possible.

If there's no use case for them, there's no point in implementing them.

However, `token id_token` makes sense to me because, as I understand it, the id_token is related to the session (authentication), and the access token is related to API access (authorization), although that could be completely wrong.