The client ID is in the "aud" claim of the ID Token (not the access token). Hmm..