How to use PKCE / OAuth
- 1. Fill authorize URL and client id. From your IdP docs.
- 2. Set redirect and scope. Must match the app registration.
- 3. Copy verifier. You will need it on the token request — that request is not sent here.
- 4. Open the authorize URL yourself. This site does not redirect you into a login.
About this tool
PKCE stops a stolen authorize code from being exchanged without the verifier. Building the URL locally is safer than a hosted 'OAuth playground' that wants to see your redirect.
S256
challenge = Base64URL(SHA-256(verifier)). Plain method is not offered.
No token call
A token endpoint would need a backend or CORS proxy. Out of scope for static Pages.
Code examples
Challenge
btoa(sha256(verifier))