OAuth and OIDC
Authorization Code with PKCE
Bind an authorization request to a one-time verifier using the S256 challenge method.
Try the OAuth playground
Select a registered application in Developer → OAuth playground. The playground loads its callback URLs and allowed scopes; there is no built-in dashboard OAuth client.
To inspect the callback and exchange tokens here, register your dashboard origin followed by /developer/playground as a callback URL on a public application, such as a SPA. The request is saved in this tab and restored after authorization. Missing request state or a different issuer blocks token exchange. Confidential applications exchange codes on their server with their registered credentials.
Create the challenge
Generate a high-entropy verifier for every authorization attempt. Hash its ASCII value with SHA-256 and base64url-encode the result without padding. Keep the verifier in the client until the callback.
import { createHash, randomBytes } from "node:crypto";
const verifier = randomBytes(48).toString("base64url");
const challenge = createHash("sha256")
.update(verifier)
.digest("base64url");Authorize
Store state with the verifier and compare it at the callback. OIDC clients should also send nonce and compare it with the ID-token claim.
GET /oauth/authorize?response_type=code
&client_id=CLIENT_ID
&redirect_uri=https%3A%2F%2Fclient.example%2Fcallback
&scope=openid%20profile
&state=RANDOM_STATE
&nonce=RANDOM_NONCE
&code_challenge=CHALLENGE
&code_challenge_method=S256Exchange once
curl -u "$CLIENT_ID:$CLIENT_SECRET" \
-H "content-type: application/x-www-form-urlencoded" \
-d grant_type=authorization_code \
-d code="$CODE" \
-d redirect_uri=https://client.example/callback \
-d code_verifier="$VERIFIER" \
https://authometry.jiayangchen.com/oauth/token