OAuth2 Flow Tester

PKCE (Proof Key for Code Exchange, pronounced 'pixy') prevents authorization code interception attacks. The client generates a random code_verifier, computes its SHA-256 hash (code_challenge), and sends the hash with the authorization request. When exchanging the code for tokens, the client sends the original verifier. Even if an attacker intercepts the authorization code, they can't get tokens without the verifier — which was never sent in the initial request. PKCE is now required for all OAuth 2.0 public clients (RFC 9700).

Authorization Code flow: the authorization server returns a short-lived code, which the client exchanges for tokens via a server-to-server request. The access token never appears in URLs. Implicit flow (now deprecated): the authorization server returns the access token directly in the URL fragment (response_type=token). Tokens in URLs are logged by browsers, proxies, and CDNs — a significant security risk. Always use Authorization Code + PKCE instead of Implicit.

The 'state' parameter is a CSRF (Cross-Site Request Forgery) token. Your app generates a random value before redirecting to the authorization server, includes it in the auth URL, and verifies it matches when the user is redirected back with the authorization code. Without state validation, an attacker can initiate an auth flow and trick a victim into completing it, linking the attacker's account to the victim's identity.

Request only the minimum scopes needed (principle of least privilege). For OpenID Connect: 'openid' is required for an ID token. 'profile' adds name/picture. 'email' adds email address. 'offline_access' requests refresh tokens for long-lived sessions. For API scopes, use resource-specific scopes (e.g. 'read:messages write:messages') rather than broad admin scopes. Users are more likely to consent to narrow, specific scopes.

After the user approves and the server redirects back with ?code=AUTH_CODE, your backend sends a POST request to the token endpoint with: grant_type=authorization_code, the code, redirect_uri (must match exactly), client_id, and code_verifier (for PKCE). The server verifies the verifier matches the challenge, then returns an access_token, optional refresh_token, and optional id_token. Never do the token exchange from client-side JavaScript — the code is only valid once.

Access tokens are short-lived credentials (typically 15 minutes to 1 hour) that authorize API calls. Include them in the Authorization header: 'Bearer <token>'. Refresh tokens are long-lived (days to months) and are used only to obtain new access tokens when the current one expires. Refresh tokens must be stored securely (HttpOnly cookies or secure server storage) — if leaked, they allow prolonged unauthorized access. Rotate refresh tokens on each use.