OAuth Flow Tester

Your app redirects the user to the authorization server's /authorize endpoint with client_id, redirect_uri, response_type=code, scope, state, and a PKCE challenge. The user authenticates there — your application never sees their credentials, which is the entire point of the flow.

On success the server redirects back to your redirect_uri with a short-lived code and your state echoed back. Your app verifies the state matches, then POSTs the code plus the PKCE verifier to /token and receives an access token, usually an ID token, and often a refresh token.

By far the most common failure is redirect_uri_mismatch, which is exact string comparison and fails on a trailing slash, a port, or a case difference in the path. Second is an invalid or missing state, usually because it wasn't persisted across the redirect. Third is the code expiring — authorization codes typically live 30 to 60 seconds and are single-use.

A subtler one: reusing an authorization code. Codes are one-shot, and a well-behaved server will revoke the tokens it already issued if a code is presented twice, on the assumption the code leaked. Double-submitting a callback handler is enough to trigger this.

The implicit flow (response_type=token) returned tokens directly in the URL fragment, with no code exchange. It exists because CORS support was once unreliable, and it leaks tokens into browser history, referrer headers, and server logs.

It is deprecated in the OAuth 2.0 Security Best Current Practice and removed in OAuth 2.1. Use the authorization code flow with PKCE for browser and mobile clients — it is what every current SDK does by default.