~/tools / 06 / oauth-token-response
OAuth / OIDC Token Mocker
The token endpoint is where OAuth integrations quietly break. Rehearse both outcomes of the authorization_code exchange: the success envelope with access_token, refresh_token, id_token and scope exactly as OIDC providers return it, and the RFC 6749 invalid_grant failure your login flow must recover from when a code is reused or expired.
— validating —
$ man oauth-flow
Everything above is encoded into the #data= fragment of the exported URL — deflated and base64url-packed by your browser. Fragments are never sent to any server, so this mock is shareable and private. Paste the URL anywhere: a teammate's browser decodes it identically.
cat ./tldr.txt
An OAuth token endpoint mocker returns the JSON an authorization server sends when exchanging a code — access_token, refresh_token, id_token, expires_in, and scope — plus the RFC 6749 invalid_grant error body, so login flows can be tested without an identity provider.
./when-to-use-this
- You need to confirm your client recovers gracefully when an authorization code is replayed or has expired.
- A machine-to-machine integration uses client_credentials and you want to verify the token cache honours expires_in.
- You are checking that an id_token is parsed for identity while the access_token is used for authorization.
./frequently-asked
- What does invalid_grant actually mean in practice?
- It is the error an authorization server returns when the grant itself is no longer usable: the authorization code was already redeemed, it expired, the redirect_uri did not match, or a refresh token was revoked. It is the single most common OAuth failure in production and the one most clients handle by hanging rather than restarting the flow.
- Why is Cache-Control: no-store on the success response?
- Because RFC 6749 requires it. Token endpoint responses contain credentials, so the specification mandates no-store to keep them out of shared caches and browser history. The template includes it so your integration matches what a real provider sends.
- Is the id_token a real OpenID Connect token?
- It is shaped like one — a JWT carrying iss, sub, aud, email, iat, and exp — but the signature is not valid, so a compliant OIDC client performing signature and issuer validation will reject it. Use it to test claim extraction and flow wiring, not verification.