OIDC Debugger — without tokens leaving your browser.
Discovery-first, PKCE-first OpenID Connect flow debugger. Paste an issuer URL, start an Authorization Code + PKCE flow, and inspect the discovery document, token response, and ID Token with full JWKS signature verification. Everything client-side — tokens never leave your browser.
Register this redirect URI with your IdP
(determined at runtime)
Three steps.
01
Register the callback URL with your IdP
Add the redirect URI shown above as an allowed callback for a public client in your IdP. The client must allow Authorization Code + PKCE.
02
Fetch discovery
Paste the issuer URL (e.g. https://your-tenant.okta.com or your Entra tenant URL). The tool fetches /.well-known/openid-configuration and validates it against OIDC Core requirements.
03
Start the flow
Click Start. You'll be redirected to your IdP, authenticate, and come back. The tool exchanges the code for tokens client-side, then validates the ID Token signature against the IdP's JWKS — no token ever touches our server.
Beyond “decode the JWT”.
Discovery document conformance
Checks that required endpoints (authorize, token, JWKS) are present, that Authorization Code is supported, that PKCE S256 is advertised, and that no unsafe signing algorithm (alg=none, HS-only) is offered.
PKCE-only flow
Only Authorization Code + PKCE (S256). Implicit Flow and ROPC are not supported — those are removed by OAuth 2.1 and pose a security risk we won't pretend is OK to debug.
JWKS signature verification
Fetches the IdP's JWKS, finds the key matching the ID Token's kid, and verifies the signature using WebCrypto (RS256 / ES256 / PS256). A failed signature is highlighted prominently.
Standard claim validation
Verifies iss matches discovery, aud includes the client_id, exp is in the future, and nonce matches the value sent in /authorize. Missing required claims (sub, iss, aud, exp, iat) are flagged.
No server-side token handling
Everything from discovery fetch through token exchange runs in your browser. Tokens never transit our server. Open DevTools → Network and you can verify: requests fire only to your IdP, never to askmeidentity.com.