All tools

OAuth / OIDC RP

Act as a Relying Party: Auth Code + PKCE, Implicit, Client Credentials — browser-direct first, CORS proxy fallback.

Identity & Auth
Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Configuration

OAuth 2.0 / 2.1 + OIDC RP. Validates iss, aud, exp, nonce. Callback: https://stbox.dev/oauth/callback

No client secret — OAuth 2.1 public clients

Must match an IdP-registered callback. Use apex https://stbox.dev/oauth/callback (www is rewritten to apex automatically). Alias: /oidc/callback.

Audience URI for the protected API (e.g. https://api.example.com). Sent on authorize and token requests. Separate multiple with spaces.

OAuth / OIDC Terminal
live
Configure the RP and run a grant to populate the terminal.

What is an OAuth / OIDC Relying Party?

A Relying Party (RP) or OAuth client redirects users to an Authorization Server, receives an authorization code or tokens, and exchanges them for access to protected APIs. OpenID Connect adds an ID token and UserInfo so apps can authenticate users, not only authorize API calls.

stbox's RP playground helps you configure endpoints, PKCE, client authentication methods, and grant types against real IdPs — useful when debugging redirect URIs, CORS on token endpoints, or confidential-client setups.

How to use this tool

  1. Enter authorization, token, and optional UserInfo endpoints (or discover them from an OIDC issuer).
  2. Choose a flow (Auth Code + PKCE recommended), set client ID/secret method, and generate the authorize URL.
  3. Complete login at the IdP, land on the stbox callback, validate state, and inspect the token response.

Frequently asked questions

Does stbox store my client secret?

Configuration can be kept in local browser storage for convenience. Token responses live in sessionStorage for the callback handoff. Nothing is retained as a long-term server-side database.

Why is there a proxy mode?

Many token endpoints block browser CORS. Auto mode tries a direct fetch first, then falls back to /api/v1/proxy/token for in-memory exchange only.