Interactive tester
Every flow, run from this page against
https://auth.mesogeos-digital.com. Each request and its response is
logged at the bottom, which is usually where the answer is.
localStorage so a page reload does not lose them. That is fine for a development
client and wrong for a production one: use a client registered for testing.
Configuration
Server
Only for confidential clients. A PKCE client has none.
Must be registered on the client, matched exactly. This page's own URL works if you registered it.
Scopes
Click to include. What you pick is sent with every flow below.
Scopes that should fail
For checking that your application handles a refusal rather than assuming success. None of these exists.
Flows
Authorization code
Leaves this page and comes back with a code. Press "Process current URL" after you return, or let the page notice the parameters itself.
Compared on return. This is the CSRF protection.
Authorization code with PKCE
The same flow with no client secret. This is the one to use for a SPA.
PKCE parameters
Client credentials
No user. Two ways to authenticate the client: the shared secret, or a signed assertion.
JWT client assertion
Signs a short-lived JWT with the client's private key instead of sending a secret. The key never leaves this browser.
Device authorization
Asks for a code, then polls. Authorize it from another device — or from another tab, which is enough to see the flow complete.
Resource owner password
JWT bearer grant
A trusted backend asserting which user it is acting for. Distinct from the client assertion above, where the JWT says which client is calling.
Off unless enabled on the client — it can obtain a token for any user, so it is not on by default.
Tokens
Operations
Refresh
Exchange for a longer-lived token
Current token
User information
What the current access token says about its owner.
Discovery
Documents
Endpoints
Read from the discovery document once you fetch it above.
| Authorization | |
| Token | — |
| Introspection | — |
| Revocation | — |
| Device authorization | — |
Session
Operations
Request log
What went over the wire
Every request this page made, with its response. When a flow fails, the answer is usually here rather than in the result panel.
Tools
URL parameters
Paste a callback URL to see what came back in it.
PKCE pair
Generate a verifier and challenge, or check a pair matches.
JWT decoder
Reads the header and payload. It does not verify the signature — decoding is not validating.
Run everything
Walks the checks that need no user interaction — configuration, discovery, health, client credentials, the token lifecycle. Useful after registering a client.