Test Authorization Server

Mint subject, actor, and custom RS256 access tokens, or publish a 5- to 60-minute issuer whose OAuth and OpenID metadata serve the public JWKS.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Mint an RS256 access token, or an ID-JAG another authorization server can redeem. An ID-JAG is signed in the browser with the published issuer as iss, so that server can discover the JWKS and verify it.

Configuration

Another issuer, such as a stbox IdP or https://idp.example, can POST an ID-JAG to the token endpoint and receive an access token for the test resource server. Or it can ask this issuer for an ID-JAG, trust that issuer, and mint an access token for its own resource server. Metadata is served with /.well-known at the end of the issuer and inserted before the path.

Minted token

What does the test authorization server do?

Token exchange and ID-JAG tests need signed subject and actor access tokens with claims you control: sub, aud, scope, exp, and may_act.

This authorization server mints those JWTs with an ephemeral RS256 key and shows the public JWKS. An IdP under test can take the tokens as subject_token and actor_token.

How to use this tool

  1. Set iss, pick a subject, actor, may_act, ID-JAG, or custom preset, and fill the claims.
  2. Mint the token and copy the JWT plus the JWKS. An ID-JAG is signed here; the other authorization server redeems it.
  3. Or publish the issuer for 5 to 60 minutes and point a client at the OAuth or OpenID metadata URL to pull the public keys.

Frequently asked questions

Is the signing key stored?

Minting keeps the private key in the browser. Publish issuer also keeps that signing key on the token endpoint until the issuer expires, so it can sign ID-JAG assertions and access tokens. The API never returns the private key. Clients discover only the public JWKS.

What does the discovery document advertise?

Each document is served twice: with /.well-known/openid-configuration or /.well-known/oauth-authorization-server appended to the issuer, and with that suffix inserted before the issuer path. All four URLs return the same document. A published signing key adds the token endpoint, token exchange, and the JWT bearer grant. Clients use jwks_uri to fetch the public keys.