OAuth 2.0 Token Helper (Get Access Tokens for API Testing)
Test tokens from your own OAuth or OpenID server — PKCE, device code, client credentials.
Try before you buy.
- Free preview: every flow run for real, with the tokens’ claims, scopes and expiry in full; the tokens and the Authorization header show only their first characters.
- Locked until you unlock it: download, copy, saving to your device and opening in another app.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Authorization server
Reads the server’s OpenID Connect discovery document (or its OAuth 2.0 server metadata). Or enter the endpoints yourself.
Endpoints
Client and flow
Use a test client’s secret: it goes only to the endpoints above and is never stored, but a production client’s secret belongs on a server, not in a browser.
Redirect URI to register:
Run it in a terminal
Tokens
Header for API calls:
Saved configurations
Kept in this browser only, without the secret and without tokens.
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the OAuth 2.0 Token Helper (Get Access Tokens for API Testing)
Get an access token for API testing without writing code. Enter an issuer URL and let the page read the server’s discovery document, or type the endpoints, then add your client ID, scopes and (for confidential clients) the secret, and run one of four flows: Authorization Code with PKCE in a sign-in pop-up that returns to this page, Device Authorization with a code to enter on another device, Client Credentials for machine-to-machine access, or a Refresh Token.
Requests go from your browser straight to your server. When the server does not allow that from a web page (CORS), the page gives you the exact cURL command to run instead and reads the JSON it prints. The result shows the decoded ID and access tokens with their claims, the scopes, an expiry countdown and a ready Authorization header; you can refresh, revoke (RFC 7009) and introspect (RFC 7662) the tokens, check an ID token’s signature against the server’s keys, and send the token to REST API Tester.
The secret, the PKCE verifier and the tokens live in this tab’s memory only. Without a pass the result is a free preview: every flow runs and the claims show in full, while the tokens and the header show only their first characters; copying them, downloading the response, the hand-over to REST API Tester and saving configurations come with a Pro pass.
How to use it
- Enter the issuer URL (for example
https://login.example.com/realms/test) and choose Fill in the endpoints, or type the authorization and token endpoints yourself. - Register the redirect URI the page shows with your authorization server, as a public (single-page) client for the PKCE flow.
- Enter the client ID and the scopes; for a confidential client choose how it authenticates and enter its secret.
- Choose the flow and press Start. For PKCE, sign in in the window that opens; for the device code, open the link (or scan the QR code) on any device and enter the code.
- Read the tokens’ claims, scopes and expiry, then refresh, introspect or revoke the tokens, or check the ID token’s signature.
- With a Pro pass, copy the access token or the header, download the response, or open REST API Tester with the token; the free preview shows the claims and the first characters of each token.
Examples
Issuer https://login.example.com · client spa-test (public) · scopes openid profile offline_access
A sign-in pop-up, then an ID token (iss, sub, aud, nonce checked), an access token expiring in 59:58 and a refresh token
Client credentials · client billing-job with a secret in HTTP Basic · scope invoices.read
Authorization: Bearer eyJhbGciOi… with its claims (scp, aud, exp)
If the server refuses browser requests, the page prints the same request as cURL, with the secret read from $CLIENT_SECRET.
Device code · client cli-tool · scope openid
Go to https://login.example.com/device and enter WDJB-MJHT — then the tokens, once approved
Common uses
- Getting a token to try an API in REST API Tester, Postman or cURL.
- Checking what claims and scopes your identity provider puts into tokens.
- Testing a new client registration, redirect URI or scope before writing code.
- Seeing whether refresh, revocation and introspection behave as documented.
How each flow works here
- Authorization Code + PKCE (RFC 6749 §4.1, RFC 7636): the page makes a random 64-character code verifier and sends its S256 challenge, a random state and (for OpenID Connect) a nonce. You sign in in a pop-up; the server sends the code back to this page, which hands it to the first tab and closes. The page checks the state (and the issuer, when the server names it, as RFC 9207 describes) and exchanges the code with the verifier.
- Device Authorization (RFC 8628): the page asks for a device code and a user code, shows the code with a link and a QR code, and polls the token endpoint at the interval the server gives (5 seconds when it gives none), 5 seconds slower whenever the server says slow_down.
- Client Credentials (RFC 6749 §4.4): the client authenticates with its secret — in HTTP Basic, with the id and secret form-encoded as §2.3.1 says, or in the request body.
- Refresh Token (RFC 6749 §6): the refresh token of the last result, or one you paste.
The implicit and password grants are not offered: the OAuth 2.0 Security Best Current Practice (RFC 9700) says clients should not use the implicit grant and must not use the password grant.
When the browser cannot send the request
Browsers send a cross-origin request only when the server allows it (CORS). Many authorization servers allow token requests from browsers only for clients registered as single-page apps, and some never allow client-credential requests from a page. Then the page shows the identical request as a cURL command: run it in a terminal (after export CLIENT_ID=… and export CLIENT_SECRET=…, so the secret never appears in the command) and paste the JSON it prints. The pop-up flow itself always works; only the token exchange needs CORS.
What the page checks
- The state of the response matches the one sent, and the issuer, when the server names it.
- The ID token’s
issis your issuer, itsaudcontains your client ID, itsnonceis the one sent, it has not expired and is not unsigned (alg: none) — OpenID Connect Core §3.1.3.7. - On request, the ID token’s signature against the keys at the JWKS URI.
- The discovery document names the issuer you entered and lists S256 for PKCE.
Sources
- RFC 6749 — OAuth 2.0
- RFC 7636 — PKCE
- RFC 8628 — Device Authorization Grant
- RFC 7009 — Token Revocation
- RFC 7662 — Token Introspection
- RFC 8414 and OpenID Connect Discovery 1.0 — server metadata
- OpenID Connect Core 1.0 — ID token validation
- RFC 9207 — the iss response parameter
- RFC 9700 — OAuth 2.0 Security Best Current Practice
Limitations
- Endpoints must use https://. A server on http://localhost can be used through the cURL commands.
- Requests from the page need the server to allow CORS; otherwise use the cURL command the page shows.
- The sign-in pop-up needs pop-ups allowed for this page, and a browser with BroadcastChannel to hand the code back.
- Client authentication with private_key_jwt or mutual TLS, DPoP-bound tokens, pushed authorization requests (PAR) and token exchange are not supported.
- Tokens are not kept: they are gone when the tab closes or you press Clear.
Privacy
Sends data to online services
Requests go from your browser straight to the authorization server you enter — never through MySmartCoPilot. The secret, code verifier and tokens stay in this tab’s memory; saved configurations keep no secrets or tokens.
Frequently asked questions
What do I get without a pass?
Without a pass, OAuth 2.0 Token Helper (Get Access Tokens for API Testing) shows every flow run for real, with the tokens’ claims, scopes and expiry in full; the tokens and the Authorization header show only their first characters. Until you unlock it, the result can’t be downloaded, copied, saved to your device or opened in another app. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Does MySmartCoPilot see my secret or tokens?
No. The page sends requests straight from your browser to the server you entered, without cookies and without a referrer. The secret, the code verifier and the tokens stay in this tab’s memory; saved configurations keep only the endpoints, client ID and scopes. One thing does pass MySmartCoPilot’s web server, as with any redirect URI: the one-time sign-in code, in the address your authorization server sends the pop-up back to (tick the fragment option, where your server supports it, to keep it out of that request). The code is useless without the code verifier, which never leaves this tab.
Which redirect URI do I register?
The one the page shows (this page’s address). Register it for a public, single-page-app client and use the Authorization Code + PKCE flow. The page removes the code from the address bar as soon as it arrives, and the code is useless without the verifier, which only this tab has. With the fragment option (response_mode=fragment) the code comes back after a # and is not sent with the page request at all.
Why does the token request fail with a network or CORS error?
The server does not allow requests from web pages for this client or endpoint. Use the cURL command the page shows, or register the client as a single-page app if your server distinguishes them.
What does the free preview show?
Every flow runs for real. You see the scopes, the expiry countdown, the decoded claims of the ID and access tokens, the checks, and introspection and revocation results; the tokens and the Authorization header show their first characters. Copying tokens and headers, downloading the response, opening the token in REST API Tester and saving configurations need a Pro pass.
Is the access token always a JWT?
No. Many servers issue opaque tokens; then the page cannot show claims, but the introspection endpoint can tell you what the token is and whether it is active.