OAuth development
Build a code-flow request or inspect a pasted callback. Start with the public example to see both sides.
Enter raw values. The registered redirect URI is preserved exactly as a parameter.
Everything runs in this browser tab. Inputs are not sent or saved.
response_type=code · authorization code flow
Keep the verifier for the token request. Only its S256 challenge enters the URL; reports exclude the verifier.
Extra parameters: one raw key=value per line. Do not pre-encode values or repeat managed fields.
Enter values or load the example.
A failed login can begin with one extra slash in a redirect address or a plus sign decoded as a space. This OAuth URL builder gives you the assembled request and its decoded parameters together, so you can compare the values your client intends to send with those actually placed in the query.
Use the OAuth callback parser when you already have a return URL from a test run. It keeps every parameter row, including duplicates, and compares a separately supplied expected state. No successful parse is presented as proof that a code, token or user identity is valid.
The OAuth URL builder derives an S256 challenge from the verifier you supply. The challenge goes into the OAuth authorization URL; the verifier stays in its input field and has a separate copy action for the later token request. Reports exclude the verifier.
A callback can contain state in its query and again in its fragment. The table preserves both rows and labels their origin. Even identical values are ambiguous, so the first matching value cannot hide a second unexpected one.
Paste the exact registered URI, including its port, query and trailing slash. Do not encode the whole URI first: the builder treats that string as one parameter value. Extra parameters take raw key=value lines, even when a value contains an ampersand.
The state nonce generator creates independent values from 32 random bytes. It replaces nonce only when scope contains openid. Review the changed field count, apply, and retain the verifier for the same transaction. Editing a scope never silently regenerates it.
Automatic mode waits 350 ms after changes. Turn it off to use Build or Parse, including Ctrl/Cmd+Enter. Copy and download stay disabled while a result is stale. Switching views preserves inputs; expected state in the callback view is entered separately.
Nested redirect queries remain a single value. Existing endpoint parameters are decoded strictly, retained and encoded again with the new fields. A raw plus in an extra value becomes %2B, while spaces in the resulting query use form encoding.
Paste a verifier containing 43–128 allowed characters or generate one explicitly. SHA-256 hashes the exact verifier bytes; it does not decode base64 first. Disabling PKCE removes the challenge and method from the URL while retaining your input.
Full URLs, ?query, #fragment and bare query strings are accepted. Decoding happens once: %252F becomes %2F, and %2B becomes a literal plus. Empty values and repeated names remain visible instead of being overwritten in an object.
Missing, empty, repeated, unchecked, matching and mismatching state values produce different messages. A code mixed with an error, duplicate keys or query/fragment data is flagged for inspection. Export includes the full parameter list, even when the table shows its first 50 rows.
Changing the scheme, port, path or trailing slash can identify a different callback. Register the exact intended value with your provider. This page preserves your redirect string as a parameter value; it cannot inspect the provider’s registered client settings.
State comes back as a callback parameter and can be compared with the original transaction value. Nonce is bound to an ID token and must be checked after validating that token. Seeing a nonce field in a pasted callback is not an ID token check.
A client secret authenticates the client at the token endpoint; PKCE also binds a code to its original verifier. Current OAuth security guidance recommends PKCE for confidential clients too. S256 is enabled here by default, but the provider must support it.
Yes. It is a public identifier. A client secret and the code_verifier serve different roles and must not go into the authorization query. The tool blocks those parameter names and gives the verifier its own copy button.
OAuth grants access to resources. OpenID Connect adds authentication, including an ID token. To prepare that request, include openid in scope and optionally supply nonce. This page builds the request; your application still needs to validate the returned ID token.
Found a calculation or validation issue?
Use the OAuth URL builder to compare a fresh request with your provider’s configuration, then inspect a pasted callback using the state you saved for that transaction.