OAuth / OIDC Client Tester

A small FastAPI web app for testing OAuth 2.0 / OpenID Connect providers as a client, using the authorization code flow.

• Store multiple client configurations in SQLite
• Public clients (none) and confidential clients (client_secret_basic, client_secret_post)
• PKCE (S256 or plain), toggleable per client
• OIDC discovery from the issuer's /.well-known/openid-configuration
• Automatic state, plus a nonce when the scope contains openid
• Extra authorization parameters (e.g. prompt=login, audience=...)
• Result page with every request and response (secrets masked), decoded JWTs (signature not verified), and buttons to call UserInfo and refresh tokens

python3 -m venv .venv
.venv/bin/pip install -r requirements.txt
.venv/bin/uvicorn app.main:app --reload --port 8000

Open http://localhost:8000, create a client, and register the redirect URI shown in the form (default http://localhost:8000/callback) at your provider. The host you use in the browser determines the default redirect URI, so use the one you registered (localhost vs 127.0.0.1).

The database lives at ./oauth_tester.db; override it with OAUTH_TESTER_DB=/path/to/file.db. Client secrets and tokens are stored in plain text. This is a local testing tool, so don't expose it.