OAuth 2.0 Playground

A browser-based OAuth 2.0 client for testing and debugging authorization flows.

Authorization code with PKCE, client credentials, implicit, and device grant. Works with Keycloak, Auth0, Google, WSO2, and FIWARE Keyrock. Credentials and tokens stay in your browser. Security boundaries.

Feedback helps improve the playground. Send yours.

Client Secret is saved locally only. For security considerations, the value can't be shared.
Loads supported authorization server endpoints into the fields below.
Query-string style params added to token and refresh requests. Example: audience=https://api.example.com/. Encode & or = if they are part of a value.
Some introspection endpoints don't allow CORS, so there's an option to proxy them through the backend.

Generates two RSA key pairs: a signing key for private_key_jwt client authentication, and an encryption key for JWE token decryption. Private keys are stored in your browser only. The signing and encryption public keys are published together to a single JWKS endpoint — give that URL to your authorization server. You can also paste existing private keys from another device to reuse the same key pair across machines.

Stored locally only. For security considerations, the value can't be shared.
Stored locally only. For security considerations, the value can't be shared.

The DPoP key is EC P-256, is never published, and is sent inline in each proof.

Stored locally only. For security considerations, the value can't be shared.
Application isn't configured
Authorization code needed
Token response:
 
Refresh token needed
User info URL needed
Get user info response:
 
Token introspection URL needed
Token introspection response:
 
End session URL needed
Revocation URL needed
Revocation URL needed
Revoke response: