Tool · client-side · no signup
OIDC Discovery Validator.
Fetch and validate an OpenID Provider's `.well-known/openid-configuration` document against OIDC Core 1.0 requirements. Surfaces missing endpoints, unsafe signing algorithms, deprecated response types, and PKCE support gaps. Client-side fetch — no proxy.
The fetch runs from your browser. The issuer must allow CORS on its discovery endpoint.
What this is good for
Typical use cases.
Diagnose why a new IdP integration won't work
Audit an internal OIDC tenant for security posture
Verify a vendor's OIDC implementation before signing the contract