OAuth / OIDC & PKCE Playground
Local processingStandards, sources and review dates
- OAuth security BCP · RFC 9700 · January 2025 · Reviewed
Authorization Code + PKCE S256, exact redirect matching, no password grant. Metadata checks do not validate an authorization server. Review interval: 90 days.
RFC 9700 · OAuth Security BCP
Prefer Authorization Code + PKCE S256. Register exact redirects; avoid implicit grants and never use the password grant. Bind and validate state and OIDC nonce in your application; this preview does not complete a login or validate tokens.
Provider discovery metadata
Authorization request
Client ID
Redirect URI
Scopes