OAuth2 & OpenID Connect Debugger

This is a simple Client to use with any OAuth2 or OpenID Connect compliant identity provider.

Configuration Parameters

Authorization Grant:Choose which Authorization Grant or OIDC Flow to test with.
Authorization Endpoint:Enter the Authorization Endpoint used by the debugger.
Token Endpoint:Enter the Token Endpoint used by the debugger.
Device Authorization Endpoint:Enter the Device Authorization Endpoint (RFC 8628) used by the debugger.
Introspection Endpoint:Enter the Introspection Endpoint used by the debugger.
Revocation Endpoint:Enter the Token Revocation Endpoint (RFC 7009) used by the debugger.
Registration Endpoint:Enter the OIDC Dynamic Client Registration Endpoint used by the debugger. Auto-populated from the discovery metadata (registration_endpoint).
OIDC UserInfo Endpoint:Enter the OIDC UserInfo Endpoint used by the debugger.
JWKS Endpoint:Enter the JWKS Endpoint used by the debugger.	Review JWKS meta data
OpenID Provider Metadata (OIDC Discovery 1.0 §3)Every member the OpenID Connect Discovery 1.0 specification defines for the OpenID Provider Metadata document. Each is pre-filled with a dummy default, is populated from the discovery document by "Populate Meta Data", and can be overridden here. Values that are JSON arrays in the document are shown comma-separated.
issuer:URL the OP asserts as its Issuer Identifier. MUST be identical to the iss claim in issued ID Tokens. (REQUIRED)
scopes supported:OAuth 2.0 scope values this server supports. Comma-separated. (RECOMMENDED)
response types supported:OAuth 2.0 response_type values this OP supports. Comma-separated (a value may itself contain spaces, e.g. “code id_token”). (REQUIRED)
response modes supported:OAuth 2.0 response_mode values this OP supports. Comma-separated. Default: query, fragment. (OPTIONAL)
grant types supported:OAuth 2.0 grant type values this OP supports. Comma-separated. Default: authorization_code, implicit. (OPTIONAL)
acr values supported:Authentication Context Class References this OP supports. Comma-separated. (OPTIONAL)
subject types supported:Subject Identifier types this OP supports — pairwise and/or public. Comma-separated. (REQUIRED)
id token signing alg values supported:JWS alg values supported for the ID Token. Comma-separated. RS256 MUST be included. (REQUIRED)
id token encryption alg values supported:JWE alg values supported for the ID Token. Comma-separated. (OPTIONAL)
id token encryption enc values supported:JWE enc values supported for the ID Token. Comma-separated. (OPTIONAL)
userinfo signing alg values supported:JWS alg values supported by the UserInfo Endpoint. Comma-separated. (OPTIONAL)
userinfo encryption alg values supported:JWE alg values supported by the UserInfo Endpoint. Comma-separated. (OPTIONAL)
userinfo encryption enc values supported:JWE enc values supported by the UserInfo Endpoint. Comma-separated. (OPTIONAL)
request object signing alg values supported:JWS alg values supported for Request Objects. Comma-separated. (OPTIONAL)
request object encryption alg values supported:JWE alg values supported for Request Objects. Comma-separated. (OPTIONAL)
request object encryption enc values supported:JWE enc values supported for Request Objects. Comma-separated. (OPTIONAL)
token endpoint auth methods supported:Client authentication methods supported by the Token Endpoint. Comma-separated. Default: client_secret_basic. (OPTIONAL)
token endpoint auth signing alg values supported:JWS alg values supported by the Token Endpoint for the private_key_jwt / client_secret_jwt assertion. Comma-separated. (OPTIONAL)
display values supported:display parameter values this OP supports. Comma-separated. (OPTIONAL)
claim types supported:Claim Types this OP supports. Comma-separated. Default: normal. (OPTIONAL)
claims supported:Claim Names this OP may supply values for. Comma-separated. (RECOMMENDED)
service documentation:URL of human-readable developer documentation for this OP. (OPTIONAL)
claims locales supported:BCP47 language tags supported for Claim values. Comma-separated. (OPTIONAL)
ui locales supported:BCP47 language tags supported for the user interface. Comma-separated. (OPTIONAL)
claims parameter supported:Whether the OP supports the claims request parameter. Spec default: false. (OPTIONAL)
request parameter supported:Whether the OP supports the request parameter. Spec default: false. (OPTIONAL)
request uri parameter supported:Whether the OP supports the request_uri parameter. Spec default: true. (OPTIONAL)
require request uri registration:Whether request_uri values must be pre-registered. Spec default: false. (OPTIONAL)
op policy uri:URL the OP provides to read about its requirements on how the Relying Party can use the data provided. (OPTIONAL)
op tos uri:URL the OP provides to read about the OpenID Provider's terms of service. (OPTIONAL)
revocation endpoint auth methods supported:Client authentication methods the Revocation Endpoint supports (RFC 8414 / RFC 7009). Comma-separated. Defined by RFC 8414, not by OpenID Connect Discovery 1.0. (OPTIONAL)
revocation endpoint auth signing alg values supported:JWS algorithms the Revocation Endpoint supports for the private_key_jwt / client_secret_jwt assertion. Comma-separated. RFC 8414 only. (OPTIONAL)
introspection endpoint auth methods supported:Client authentication methods the Introspection Endpoint supports (RFC 8414 / RFC 7662). Comma-separated. RFC 8414 only. (OPTIONAL)
introspection endpoint auth signing alg values supported:JWS algorithms the Introspection Endpoint supports for the private_key_jwt / client_secret_jwt assertion. Comma-separated. RFC 8414 only. (OPTIONAL)
code challenge methods supported:PKCE code challenge methods the authorization server supports (RFC 7636), e.g. S256, plain. Comma-separated. RFC 8414 only. (OPTIONAL)
signed metadata:A JWT of this metadata document signed by the issuer (RFC 8414 section 2.1). Use Validate Signature in the Metadata Retrieval pane to verify it. RFC 8414 only. (OPTIONAL)
Display OIDC Related Artifacts?Some OAuth2 identity providers return OIDC-related tokens even for plain OAuth2 calls. This option will display tokens in this case.	Yes No
SSL Certificate Validation:Should the backend debugger component validate the Identity Provider SSL/TLS certificate?	Yes No
Use Refresh Token: Show Refresh Token panel?	Yes No
Use PKCE: Use Proof Key for Code Exchange (RFC-7636)?	Yes No

Tools

OIDC Dynamic Client Registration

Metadata Source:Which metadata document to retrieve. OpenID Connect Discovery 1.0 describes an OpenID Provider; RFC 8414 describes an OAuth 2.0 Authorization Server and defines largely the same members. Either one populates the Configuration Parameters pane below.	OIDC Discovery 1.0 OAuth 2.0 Authorization Server Metadata (RFC 8414)
	An OIDC Discovery endpoint uses a path that ends in /.well-known/openid-configuration. See the spec.
Metadata Endpoint URL:The metadata endpoint URL for your provider — an OIDC Discovery document or an RFC 8414 authorization server metadata document, per the Metadata Source above. Retrieving it auto-populates the Configuration Parameters pane.


Verify the digital signature on an RFC 8414 metadata document. RFC 8414 lets an authorization server publish a signed_metadata member — a JWT of the metadata signed by the issuer. This fetches the document's jwks_uri, verifies the JWS against those keys in the browser, checks that the iss claim is the issuer, and reports any signed claim that disagrees with the plain JSON. OIDC Discovery documents do not define signed_metadata.

State:Auto-generated state value.
Nonce:Auto-generated nonce value.
Client ID:The client identifier that belongs to the application registered with the identity provider.
Redirect URL:The redirect URL registered with the identity provider. By default use http://localhost:3000.
Scope:The requested scope.
Add Resource field?Some identity providers require the resource parameter..	Yes No
Resource:The resource parameter, together with scope, tells the Identity Provider what audience or scope is desired with the access token.
Custom query parametersCustom query parameters for Authorization Endpoint call.	Yes No
How many custom parameters:How many custom query parameters will this request have? No more than ten.

PKCE code_challengePKCE RFC code_challenge.	(Included in request sent to Authorization Endpoint.)
PKCE code_verifierPKCE RFC code_verifier.	(Included in request sent to Token Endpoint.
PKCE code_methodPKCE RFC code_method.	(Included in request sent to Authorization Endpoint.)

	Create, read, update, and delete a client on the Identity Provider using the OIDC Dynamic Client Registration protocol. See the OIDC Registration spec (and RFC 7591 / RFC 7592).
Registration Endpoint:The OIDC Dynamic Client Registration Endpoint. Kept in sync with the Registration Endpoint in the Configuration Parameters pane above, and auto-populated from the discovery metadata (registration_endpoint).
Initial Access Token:Optional bearer token presented when creating a client. Some Identity Providers require an initial access token to register; leave blank for open registration.
Client Metadata (JSON):The client metadata sent on create (POST) and update (PUT). Populated from the discovery metadata and the Redirect URL above.
Request:The HTTP request that "Register New Client" will send to the Registration Endpoint (a POST of the client metadata).


Registration Client URI:The client configuration endpoint (registration_client_uri) returned at registration. Used to read, update, and delete the client. Editable so you can manage a previously registered client.
Registration Access Token:The registration_access_token returned at registration. Presented as a bearer token to read, update, and delete the client (RFC 7592).

Response:The response from the Dynamic Client Registration endpoint.


RequestThis field shows the request that is made to th Authorization Endpoint.