Test Resource Server

Validate an OAuth bearer token, or publish a resource URL for up to 60 minutes that checks trusted issuers, discovered JWKS, and required scopes.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Validate an OAuth bearer token the way a resource server would: trusted issuer, signature from discovered JWKS, expiry, audience, and the scopes required for a resource. The live endpoint tab publishes a URL an HTTP client can call for a few minutes.

Configuration

One trusted issuer per line. Validate and the live endpoint use this same list. A URL matches iss exactly, so add each one, for example https://idp.stbox.dev and https://idp.stbox.dev/oauth. A bare domain such as idp.stbox.dev trusts that host and its subdomains at the origin. Add idp.stbox.dev/oauth on its own line for that path. Discovery appends /.well-known/openid-configuration and /.well-known/oauth-authorization-server to the issuer, and uses the document only when its issuer matches.

Validation

Configure a resource and its scopes, then validate a bearer token.

What does the test resource server check?

A resource server accepts a bearer access token only from issuers it trusts, and only when the token is signed, unexpired, and carries the scopes for that resource.

This workbench lets you name those issuers, discover their JWKS from openid-configuration or oauth-authorization-server, and set the scopes required for a resource such as user or a data point.

How to use this tool

  1. Paste the bearer token and list the authorized issuers or a trusted domain.
  2. Discover the issuer from the token iss, or paste a JWKS from the test authorization server.
  3. Set the resource and its required scopes, then validate. Or publish a URL for 5 to 60 minutes and call it from Postman.

Frequently asked questions

Which discovery document is used?

Discovery appends /.well-known/openid-configuration to the issuer, then /.well-known/oauth-authorization-server. The document is used only when its issuer matches. The live endpoint does this only after the token issuer matches a trusted issuer or domain.

What does the live endpoint return?

A valid token with the required scopes releases the resource as JSON. A missing or invalid token is 401 with a Bearer challenge that includes the RFC 9728 resource_metadata URL. A valid token that lacks the scopes is 403 insufficient_scope. The URL lasts 5, 10, 15, 30, 45, or 60 minutes.