Terms of Service

These Terms of Service ("Terms") govern your use of OAuth 2.0 Playground (the "Service"), available at oauthplayground.io (the "Site"). The Service is operated by Michael Mineev ("we," "us," or "our"). By using the Service you agree to these Terms. If you do not agree, please do not use the Service.

Our Privacy Policy explains how we handle personal data and forms part of these Terms.

1. What the Service is

OAuth 2.0 Playground is a free developer tool for inspecting and testing OAuth 2.0 and OpenID Connect flows. You supply your own authorization server endpoints and client details, and the Service acts as an OAuth client so you can see each step of the flow.

The Service is a debugging and learning aid, not a production client runtime, and not an identity provider. Do not rely on it to authenticate real users, to safeguard production credentials, or as part of any live system.

2. Accounts and sign-in

Core testing does not require registration. You can use the playground without signing in, and in that mode nothing you configure is sent to us except where you explicitly publish a key or route a request through our proxy, as described in section 4.

You may optionally sign in, through an identity service we operate that also supports signing in with a Google account, to enable account-linked features: higher rate limits on requests routed through our server, and synchronisation of saved configurations across your browsers. That identity service keeps its own account records, such as your email address. The playground itself stores only a stable, pseudonymous account identifier, which is what your synced configurations are stored against; it authenticates your requests using the access token your browser sends, and does not keep that token or the claims it carries. The Privacy Policy sets out what we hold in each place and how to have it deleted.

Where an OAuth flow you are testing signs you in to a third-party identity provider, that sign-in is with that provider, not with us, and does not create an OAuth 2.0 Playground account. Any tokens and responses it returns are handled as described in section 4.

3. Acceptable use

You agree not to:

• use the Service against any authorization server, client, or account you do not own or are not explicitly authorized to test;
• use the Service to attack, probe, overload, or gain unauthorized access to any system or data;
• publish keys, configuration, or other content that is unlawful, infringing, or that you have no right to publish;
• interfere with the Service or the Site, including by automated scraping, excessive request volume, or attempts to circumvent rate limits, security controls, or spam protection;
• use the Service in breach of any applicable law or of the terms of any third-party provider you connect to it.

You are solely responsible for everything you do with the Service and for any credentials, data, or systems you expose through it.

4. Your configuration, credentials, and keys

By default the playground runs entirely in your browser: the OAuth configuration, client secrets, private keys, and tokens you work with are held in your browser's local storage and are not sent to our server. Three optional features are exceptions, and each one sends data to us when you choose to use it:

• Saved configuration sync - if you sign in and sync a saved configuration, its full contents are uploaded to our server, including the client secret and any signing, encryption, or DPoP private keys it holds. We store each configuration encrypted at rest and decrypt it to return it to your browser when you load it, so this is not end-to-end encryption: the plaintext passes through our server. A synced configuration stays there until you delete or unsync it, or until you ask us to remove it.
• Backend proxy - where you choose to route a pushed authorization request or a token introspection request through our server instead of calling the provider directly from your browser, we receive that request, forward it to the provider you named, and return the response to you. That includes whatever the request contains: client credentials, tokens, and DPoP proofs. We process it only to perform the request, and we do not store the request body or the provider's response; our server logs record the target host and the response status, not their contents.
• Published JWKS keys - private keys stay in your browser, but a public key you choose to publish is stored on our server and served from our JWKS endpoint so authorization servers can discover it, together with the IP address that published it. By publishing a key you grant us permission to host and serve it.

Because the Service displays tokens and responses in the clear, and because the features above deliberately send data to us, you should use test clients and test accounts. Do not enter production secrets, long-lived credentials, or real end-user data. The Privacy Policy sets out what we store in each case and for how long.

5. Third-party providers

The Service connects to authorization servers and identity providers that you choose, including third parties such as Google, Auth0, Keycloak, WSO2 Identity Server, and FIWARE Keyrock. We do not control those services, and your use of them is governed by their own terms and privacy policies. We are not responsible for their availability, behaviour, or the data they return.

Where you sign in with a provider you are testing, the Service receives the tokens and profile data that provider returns and handles them only for the purpose of the flow you are testing. By default that happens entirely in your browser, which is where the data is held and displayed. Where you have selected the backend proxy for a pushed authorization or token introspection request, the request and the provider's response to it also pass through our server, as described in section 4. We do not use that data for any other purpose, do not transfer it to anyone other than the provider you directed the request to, and do not use it for advertising. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Intellectual property

The Site, its content, and its underlying software are owned by us or our licensors and are protected by intellectual property laws. These Terms grant you no rights in our trade marks or branding. Third-party names and logos shown in the Service belong to their respective owners and are used only to identify those providers.

7. Feedback

If you send us feedback, suggestions, or bug reports, you grant us a non-exclusive, worldwide, royalty-free licence to use them to operate and improve the Service, without obligation or compensation to you.

8. Availability and changes

The Service is provided free of charge and on an as-available basis. We may change, suspend, or discontinue parts of it, including the JWKS endpoint and any published keys. Where a change materially reduces the Service and we can reasonably give advance notice, we will post it on the Site before the change takes effect; changes needed for security, legal compliance, or to protect the Service may take effect immediately. We may also limit or block access where we reasonably believe these Terms have been breached or the Site is being abused. You can stop using the Service at any time, and you can delete your synced configurations from within the app.

9. Disclaimer of warranties

To the fullest extent permitted by law, the Service is provided "as is" and "as available," without warranties of any kind, whether express or implied, including any implied warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted or error-free operation. Nothing in the Service is legal, security, or compliance advice, and its output should not be treated as an authoritative statement of any specification.

10. Limitation of liability

To the fullest extent permitted by law, we will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, data, credentials, or goodwill, arising out of or in connection with your use of, or inability to use, the Service. Our total aggregate liability arising out of or relating to the Service is limited to EUR 100.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, or for fraud. If you are a consumer, you keep any mandatory rights you have under the law of your country of residence.

11. Indemnity

If you use the Service for business or professional purposes, you agree to indemnify and hold us harmless from third-party claims, losses, liabilities, and expenses (including reasonable legal fees) arising from your unlawful use of the Service or your breach of these Terms. This section does not apply where you use the Service as a consumer, and it does not affect any mandatory rights you have under consumer law.

12. Changes to these Terms

We may update these Terms from time to time. For material changes we will post the revised Terms on this page and revise the "Last updated" date above before they take effect, and continued use of the Service after that date means you accept them. If you do not accept a change, stop using the Service; you can delete your synced configurations from within the app and ask us to remove any key you have published.

13. Governing law

These Terms are governed by the laws of Georgia, without regard to its conflict of law rules, and the courts of Tbilisi, Georgia have exclusive jurisdiction over any dispute arising from them. If you are a consumer, this does not deprive you of the protection of the mandatory consumer law of your country of residence, and you may also bring proceedings in the courts of that country where its law gives you that right.

14. Contact

OAuth 2.0 Playground - Michael Mineev
General and legal enquiries: hello@oauthplayground.io
Privacy and data protection: privacy@oauthplayground.io
You can also use the feedback form.