-
This very much depends on the app which api you want to access. Often apps use accessTokens for this instead of login sessions. OpenID Connect is a subset mostly doing the authentication, but not the authorization here, so for REST API usage, I would prefer tokens.
-