OIDC and OAuth flow demos
Pick a flow below to build a login link by hand and watch the raw HTTP traffic, or use one of the tools to inspect tokens and URLs.
Flows
Implicit flow (form post)
Same flow, but the tokens are posted back to the app instead of appearing in the URL.
Try itAuthorization code flow
The standard flow: get a code, then exchange it for tokens on the back channel.
Try itAuthorization code flow + PKCE
The recommended flow for public clients, adding a code verifier and challenge.
Try itClient credentials flow
Machine-to-machine access with just a client id and secret, no user involved.
Try itRefresh tokens
Get a refresh token with offline_access, then use it to silently get new access tokens.
Combining the flows
One client holding two tokens: its own for background work, and the signed-in user's for work done on their behalf.
Try itTools
Token introspection
Send a token (opaque or JWT) to the introspection endpoint and see if it is still active.
OpenToken revocation
Send a refresh token to the revocation endpoint and watch the client fail on its next refresh.
OpenOAuth URL Inspector
Paste an OAuth/OIDC URL and see its query string and fragment parameters broken out.
OpenBase64 encode/decode
Encode text to Base64, or decode a Base64 string back to text. Supports standard and URL-safe Base64.
Openat_hash calculator
Work out the at_hash claim from an access token, and check it against the one in an ID token.
Symmetric signed token generator
Build a JWT by hand, sign it with HS256 and a shared secret, then call the payment API with it.
OpenAsymmetric signed token generator
Build the same JWT, sign it with RS256 and a private key, then verify it anywhere using only the public key.
OpenSign with your own key
Paste a private key from OpenSSL, pick RS, PS or ES, and sign the same token with all three hash sizes.
OpenPEM to JWK converter
Turn an OpenSSL key into the JSON an OpenID Provider publishes at its jwks_uri, with its RFC 7638 kid.
Open