CIBA (Decoupled Auth)

Live OpenID CIBA /bc-authorize and token grants (Poll / Ping / Push) via browser-direct or stbox proxy — snippets, poll simulator, notification inbox.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Live OpenID CIBA /bc-authorize and urn:openid:params:grant-type:ciba via browser-direct or stbox HTTP proxy. Poll simulator + Ping/Push notification inbox included.

🔒 100% Client-Side Cryptography (Web Crypto API)

Configuration

Click Build /bc-authorize to generate body, auth headers, and snippets.

What is CIBA?

Client-Initiated Backchannel Authentication (OpenID CIBA) lets a client start authentication without a browser redirect. The OP authenticates the user on a separate device/app, then the client obtains tokens via Poll, Ping, or Push delivery.

This workbench helps you craft /bc-authorize parameters (hints, binding_message, client auth), CIBA grant token requests, and inspect expected poll errors — without uploading secrets to stbox.

How to use this tool

  1. Choose Poll, Ping, or Push; fill scope, client auth, and a user hint; optionally sign a request JWT.
  2. Build /bc-authorize snippets (curl/fetch/Node), then build the /token grant with auth_req_id.
  3. Use the poll simulator for authorization_pending / slow_down / expired_token / access_denied, or inspect Ping/Push callback shapes.

Frequently asked questions

Does stbox call my OpenID Provider?

When you click Submit, yes — via browser-direct or the stbox HTTP proxy (same BYOP settings as OAuth). Ping/Push can use a temporary webhook inbox on stbox to capture notifications.

What is the CIBA grant type?

urn:openid:params:grant-type:ciba — used at the token endpoint with auth_req_id after a successful backchannel authentication request.