~/tools / 06 / oauth-token-response
OAuth / OIDC Token Mocker
The token endpoint is where OAuth integrations quietly break. Rehearse both outcomes of the authorization_code exchange: the success envelope with access_token, refresh_token, id_token and scope exactly as OIDC providers return it, and the RFC 6749 invalid_grant failure your login flow must recover from when a code is reused or expired.
compose payload
— validating —
exported mock url
simulated response headers
content-type: application/json
cache-control: no-store
pragma: no-cache
$ man oauth-flow
Everything above is encoded into the #data= fragment of the exported URL — deflated and base64url-packed by your browser. Fragments are never sent to any server, so this mock is shareable and private. Paste the URL anywhere: a teammate's browser decodes it identically.