OAuth 2.0 & OIDC Debugger
Build, inspect and fix OAuth and OIDC flows
One workspace for OAuth and OIDC problems
The debugger covers the steps where sign-in flows usually break: building the authorization URL, creating a PKCE verifier and challenge, reading the callback, inspecting ID and access tokens, comparing redirect URIs, and explaining OAuth error codes. Values flow between sections, so a generated challenge is added to the URL and a token from the callback opens in the Token Inspector.
Local and secret-safe
Everything runs in your browser. The tool never asks for a client secret, never exchanges codes for tokens, and makes no network requests; opening the authorization URL is the only action that contacts your provider, in a new tab. Codes, tokens and verifiers are masked by default, kept in memory only, and never stored, logged or added to the page URL. Only the selected section is remembered.
Decoding is not verification
The Token Inspector decodes JWT headers and claims and checks iss, aud, azp, sub, scope, scp, exp, nbf, iat, nonce, alg and kid against the values you expect, with a configurable clock skew. It does not fetch JWKS keys or verify signatures, so decoded claims are unverified until your server validates the signature. Opaque and encrypted tokens are identified instead of guessed.
Standards behind the checks
Checks follow RFC 6749 (OAuth 2.0), RFC 6750 (bearer tokens), RFC 7636 (PKCE, including its test vector), RFC 8252 (native and loopback redirects), RFC 9207 (issuer in the callback), RFC 9068 (JWT access tokens) and OpenID Connect Core, plus the OAuth 2.1 direction to use the code flow with PKCE. Provider behaviour varies, so warnings explain the reason instead of claiming a request will fail.
