OAuth / OIDC Flow Debugger
Follow a sign-in request from authorization URL to callback. Inspect PKCE, state, redirect URIs and OIDC nonce claims, entirely in your browser.
Try a trace:
About this tool
OAuth / OIDC Flow Debugger
Paste an authorization URL and, optionally, the URL returned to your application. The debugger identifies the visible flow, explains decoded query and fragment parameters, and flags missing fields, duplicate parameters, insecure transport and front-channel token delivery.
Optional checks compare an original PKCE verifier with its challenge, compare redirect_uri with a supplied registration value, and compare the request nonce with an unverified ID-token claim. Examples use fictional domains and the published RFC 7636 PKCE test vector.
This is a trace inspector, not a login client or security certification. It does not fetch provider metadata, exchange authorization codes, validate token signatures or confirm server-side enforcement. Request objects, PAR references, JARM responses and form_post bodies require separate inspection. All inputs remain in tab memory; copied findings omit input values.
When to use it
Find a callback mismatch
Compare the requested redirect URI and returned destination, then supply the exact registered URI to check for differences such as a trailing slash.
Diagnose a PKCE failure
Provide the original code verifier to test whether it produces the challenge in the authorization URL, without making a token request.
Review a sign-in trace
Compare state, identify token delivery through the browser and inspect provider error parameters locally.
Questions
Are my URLs or tokens uploaded?
No. Inspection happens in your browser. The tool does not send inputs to a server, store them in browser storage or add them to the page URL. Clear inputs to remove them from the tool's active state.
Does matching a nonce verify my ID token?
No. The comparison uses an unverified JWT payload. Your application must validate the token's signature, issuer, audience, expiry and other required claims before trusting it.
Is missing state always an error?
No. Correctly implemented, transaction-bound PKCE or an OIDC nonce can provide CSRF protection in suitable flows. This tool flags missing state for review because a URL cannot prove those protections were implemented correctly.
Can it debug native application callbacks?
It can inspect absolute custom-scheme and loopback callback URLs. Native platform ownership and provider registration still need review. The registration comparison is strict and does not apply native loopback port exceptions automatically.
Related resources
Protocol references