CIBA (Decoupled Auth)

Live OpenID CIBA /bc-authorize with real Poll loops and Ping/Push webhook delivery via ephemeral inbox — plus snippets and a local poll simulator.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Live OpenID CIBA /bc-authorize and urn:openid:params:grant-type:ciba with real Poll loops and Ping/Push webhook delivery (ephemeral inbox).

🔒 100% Client-Side Cryptography (Web Crypto API)

Configuration

Register backchannel_token_delivery_mode at the OP — not sent on /bc-authorize.

Live Poll

Calls the real token endpoint with auth_req_id on an interval. Handles authorization_pending / slow_down (+5s) until tokens or a terminal error.

  • No live polls yet. Submit /bc-authorize, then Start polling.
Local sim (no network)

Educational walkthrough of poll error shapes — not a live OP call.

    What is CIBA?

    Client-Initiated Backchannel Authentication (OpenID CIBA) lets a client start authentication without a browser redirect. The OP authenticates the user on a separate device/app, then the client obtains tokens via Poll, Ping, or Push delivery.

    This workbench runs live /bc-authorize and token grants against your OP (browser-direct or stbox proxy), auto-polls on an interval, and captures Ping/Push callbacks on an ephemeral webhook inbox — without uploading secrets to stbox.

    How to use this tool

    1. Choose Poll, Ping, or Push; fill scope, client auth, and a user hint; register delivery mode and (for Ping/Push) client_notification_endpoint at the OP.
    2. Submit /bc-authorize. For Poll, open Delivery → Start polling. For Ping/Push, create the notification inbox and wait for SSE events (Ping auto-calls /token).
    3. Use Build snippets (curl/fetch/Node) when integrating your own client. The local poll sim is reference-only.

    Frequently asked questions

    Does stbox call my OpenID Provider?

    When you click Submit or Start polling, yes — via browser-direct or the stbox HTTP proxy. Ping/Push use a temporary webhook inbox so the OP can POST notifications to this host.

    Are notification inboxes durable?

    No. Hooks are in-memory and reset on server restart. The OP must be able to reach your stbox URL (local or deployed). Use them for integration testing, not production callbacks.

    What is the CIBA grant type?

    urn:openid:params:grant-type:ciba — used at the token endpoint with auth_req_id after a successful backchannel authentication request.