OAuth2 & OpenID Connect Debugger

Configuration Parameters

Authorization Grant:Choose which Authorization Grant or OIDC Flow to test with.
Authorization Endpoint:Enter the Authorization Endpoint used by the debugger.
Token Endpoint:Enter the Token Endpoint used by the debugger.
Introspection Endpoint:Enter the Introspection Endpoint used by the debugger.
Revocation Endpoint:Enter the Token Revocation Endpoint (RFC 7009) used by the debugger.
Registration Endpoint:Enter the OIDC Dynamic Client Registration Endpoint used by the debugger. Auto-populated from the discovery metadata (registration_endpoint).
Device Authorization Endpoint:Enter the Device Authorization Endpoint (RFC 8628) used by the debugger.
OIDC UserInfo Endpoint:Enter the OIDC UserInfo Endpoint used by the debugger.
JWKS Endpoint:Enter the JWKS Endpoint used by the debugger.	Review JWKS meta data
OpenID Provider Metadata (OIDC Discovery 1.0 §3)Every member the OpenID Connect Discovery 1.0 specification defines for the OpenID Provider Metadata document. Each is pre-filled with a dummy default, is populated from the discovery document by "Populate Meta Data", and can be overridden here. Values that are JSON arrays in the document are shown comma-separated.
issuer:URL the OP asserts as its Issuer Identifier. MUST be identical to the iss claim in issued ID Tokens. (REQUIRED)
scopes supported:OAuth 2.0 scope values this server supports. Comma-separated. (RECOMMENDED)
response types supported:OAuth 2.0 response_type values this OP supports. Comma-separated (a value may itself contain spaces, e.g. “code id_token”). (REQUIRED)
response modes supported:OAuth 2.0 response_mode values this OP supports. Comma-separated. Default: query, fragment. (OPTIONAL)
grant types supported:OAuth 2.0 grant type values this OP supports. Comma-separated. Default: authorization_code, implicit. (OPTIONAL)
acr values supported:Authentication Context Class References this OP supports. Comma-separated. (OPTIONAL)
subject types supported:Subject Identifier types this OP supports — pairwise and/or public. Comma-separated. (REQUIRED)
id token signing alg values supported:JWS alg values supported for the ID Token. Comma-separated. RS256 MUST be included. (REQUIRED)
id token encryption alg values supported:JWE alg values supported for the ID Token. Comma-separated. (OPTIONAL)
id token encryption enc values supported:JWE enc values supported for the ID Token. Comma-separated. (OPTIONAL)
userinfo signing alg values supported:JWS alg values supported by the UserInfo Endpoint. Comma-separated. (OPTIONAL)
userinfo encryption alg values supported:JWE alg values supported by the UserInfo Endpoint. Comma-separated. (OPTIONAL)
userinfo encryption enc values supported:JWE enc values supported by the UserInfo Endpoint. Comma-separated. (OPTIONAL)
request object signing alg values supported:JWS alg values supported for Request Objects. Comma-separated. (OPTIONAL)
request object encryption alg values supported:JWE alg values supported for Request Objects. Comma-separated. (OPTIONAL)
request object encryption enc values supported:JWE enc values supported for Request Objects. Comma-separated. (OPTIONAL)
token endpoint auth methods supported:Client authentication methods supported by the Token Endpoint. Comma-separated. Default: client_secret_basic. (OPTIONAL)
token endpoint auth signing alg values supported:JWS alg values supported by the Token Endpoint for the private_key_jwt / client_secret_jwt assertion. Comma-separated. (OPTIONAL)
display values supported:display parameter values this OP supports. Comma-separated. (OPTIONAL)
claim types supported:Claim Types this OP supports. Comma-separated. Default: normal. (OPTIONAL)
claims supported:Claim Names this OP may supply values for. Comma-separated. (RECOMMENDED)
service documentation:URL of human-readable developer documentation for this OP. (OPTIONAL)
claims locales supported:BCP47 language tags supported for Claim values. Comma-separated. (OPTIONAL)
ui locales supported:BCP47 language tags supported for the user interface. Comma-separated. (OPTIONAL)
claims parameter supported:Whether the OP supports the claims request parameter. Spec default: false. (OPTIONAL)
request parameter supported:Whether the OP supports the request parameter. Spec default: false. (OPTIONAL)
request uri parameter supported:Whether the OP supports the request_uri parameter. Spec default: true. (OPTIONAL)
require request uri registration:Whether request_uri values must be pre-registered. Spec default: false. (OPTIONAL)
op policy uri:URL the OP provides to read about its requirements on how the Relying Party can use the data provided. (OPTIONAL)
op tos uri:URL the OP provides to read about the OpenID Provider's terms of service. (OPTIONAL)
revocation endpoint auth methods supported:Client authentication methods the Revocation Endpoint supports (RFC 8414 / RFC 7009). Comma-separated. Defined by RFC 8414, not by OpenID Connect Discovery 1.0. (OPTIONAL)
revocation endpoint auth signing alg values supported:JWS algorithms the Revocation Endpoint supports for the private_key_jwt / client_secret_jwt assertion. Comma-separated. RFC 8414 only. (OPTIONAL)
introspection endpoint auth methods supported:Client authentication methods the Introspection Endpoint supports (RFC 8414 / RFC 7662). Comma-separated. RFC 8414 only. (OPTIONAL)
introspection endpoint auth signing alg values supported:JWS algorithms the Introspection Endpoint supports for the private_key_jwt / client_secret_jwt assertion. Comma-separated. RFC 8414 only. (OPTIONAL)
code challenge methods supported:PKCE code challenge methods the authorization server supports (RFC 7636), e.g. S256, plain. Comma-separated. RFC 8414 only. (OPTIONAL)
signed metadata:A JWT of this metadata document signed by the issuer (RFC 8414 section 2.1). Use Validate Signature in the Metadata Retrieval pane to verify it. RFC 8414 only. (OPTIONAL)
Display OIDC Related Artifacts?Some OAuth2 identity providers return OIDC-related tokens even for plain OAuth2 calls. This option will display tokens in this case.	Yes No
SSL Certificate Validation:Should the backend debugger component validate the Identity Provider SSL/TLS certificate?	Yes No
Use Refresh Token: Show Refresh Token panel?	Yes No
Use PKCE: Use Proof Key for Code Exchange (RFC-7636)?	Yes No

Tools

Exchange Authorization Code for Access Token

Authorization Code:The authorization code that should be passed to the Token Endpoint. This field is auto-populated based on the authorization endpoint response.	This is populated automatically when needed.
User Code:RFC 8628 user_code. Enter this code at the Verification URI to authorize the device, then click "Get Token".
Verification URI:RFC 8628 verification_uri. Open this URL in a browser and enter the user code to authorize the device.
Verification URI (complete):RFC 8628 verification_uri_complete. The verification URI with the user code already included (if the IdP provides it).
Device Code:RFC 8628 device_code. Sent to the Token Endpoint when polling for the access token. Auto-populated.
Client ID:The client identifier assigned to the client being tested.
Client Secret:The client secret assigned to the client being tested. This field is optional.
Auth Style:Authenticate application through post body parameters or authorization request header.	POST Header
Initiate Token Endpoint Call From front or backend.:The debugger can initiate a Token Endpoint call from either the frontend (browser) or from the backend API component. Certain IdPs make stringent assumptions about CORS and how calls will be originated. Especially concerning the Origin request header, which cannot be controlled from the browser.	Front Back
Redirect URL:The redirect URI registered with the Identity Provider. Using the default configuration, this value should be http://localhost:3000/callback
ScopeThe desired scope of the access token.
Username:The username for the Resource Owner Password Credential Grant.
Password:The password for the Resource Owner Password Credential Grant.
Add Resource field?Does the identity provider require a resource parameter?	Yes No
Resource:Does the identity provider require a resource parameter?
PKCE code_challengePKCE RFC code_challenge.	(Included in request sent to Authorization Endpoint.)
PKCE code_verifierPKCE RFC code_verifier.	(Included in request sent to Token Endpoint.)
PKCE code_methodPKCE RFC code_method.	(Included in request sent to Authorization Endpoint.)
Custom query parametersCustom query parameters for Authorization Endpoint call.	Yes No
How many custom parameters:How many custom query parameters will this request have? No more than ten.


RequestThe request to the Token Endpoint.

Obtain New Access Token Using Refresh Token

Refresh Token:The refresh token received in the last step. This field is auto-populated.
Client ID:The client identifier assigned to the client being tested.
Client Secret:The client secret assigned to the client being tested. This field is optional.
Auth Style:Authenticate application through post body parameters or authorization request header.	POST Header
Initiate Token Endpoint Call From front or backend.:The debugger can initiate a Token Endpoint call from either the frontend (browser) or from the backend API component. Certain IdPs make stringent assumptions about CORS and how calls will be originated. Especially concerning the Origin request header, which cannot be controlled from the browser.	Front Back
ScopeThe requested scope. Must be the same as the original scope or subset.

RequestThe requst to the Token Endpoint.

RP-initiated Logout

Token Revocation (RFC 7009)

Revocation Endpoint:The OAuth2 Token Revocation Endpoint (RFC 7009). Auto-populated from the discovery document.
Token:The access or refresh token to revoke. Use the "Revoke Token" links above each token to auto-populate this field.
Token Type Hint:Optional hint that helps the server look up the token (RFC 7009 Section 2.1).
Client ID:The client identifier assigned to the client being tested.
Client Secret:The client secret assigned to a confidential client. Leave blank for public clients.
Auth Style:Authenticate the client through post body parameters or the HTTP Basic authorization request header.	POST Header
Initiate Revocation Endpoint Call From front or backend.:The debugger can initiate the Revocation Endpoint call from either the frontend (browser) or from the backend API component. Certain IdPs make stringent assumptions about CORS and how calls will be originated.	Front Back

RequestThe request to the Revocation Endpoint.

Token Exchange (RFC 8693)

Token Endpoint:The OAuth2 Token Endpoint. Token Exchange (RFC 8693) is performed against the Token Endpoint. Auto-populated from the discovery document.
Grant Type:The token exchange grant type (RFC 8693 Section 2.1). Fixed value.
Exchange Type:Impersonation: the requesting client acts as the subject (no actor token). Delegation: the actor acts on behalf of the subject, so an actor token is included (RFC 8693 Section 1.1).	Impersonation Delegation
Subject Token:REQUIRED. The token representing the identity on whose behalf the request is made. Defaults to the most recent access token obtained from the Token Endpoint (RFC 8693 Section 2.1).
Subject Token Type:REQUIRED. An identifier for the type of the subject token (RFC 8693 Section 3).
Actor Token:OPTIONAL (delegation only). A token representing the identity of the acting party (RFC 8693 Section 2.1).
Actor Token Type:REQUIRED when an actor token is present; identifies its type (RFC 8693 Section 2.1).
Requested Token Type:OPTIONAL. An identifier for the type of token the client wants back. If omitted, the server decides (RFC 8693 Section 2.1).
Resource:OPTIONAL. URI indicating the target service/resource where the requested token will be used (RFC 8693 Section 2.1). May be repeated; enter one value for now.
Audience:OPTIONAL. The logical name of the target service where the requested token will be used (RFC 8693 Section 2.1).
Scope:OPTIONAL. A space-delimited list of requested scopes for the issued token (RFC 8693 Section 2.1).
Client ID:The client identifier assigned to the client being tested.
Client Secret:The client secret assigned to a confidential client. Leave blank for public clients.
Auth Style:Authenticate the client through post body parameters or the HTTP Basic authorization request header.	POST Header
Initiate Token Endpoint Call From front or backend.:The debugger can initiate the Token Endpoint call from either the frontend (browser) or from the backend API component. Certain IdPs make stringent assumptions about CORS and how calls will be originated.	Front Back

RequestThe request to the Token Endpoint.

ID Token Hint:Using the previously issued ID token helps OP avoid DDOS
End Session Endpoint:Usually provided by OP
Client ID:When providing client ID and ID token hint, OP must verify.
Post-Logout Redirect URIWhen the OP completes logout, it can redirect back to RP.