OAuth / OIDC RP

Act as a Relying Party: Auth Code + PKCE, Implicit/Hybrid response types, form_post, Client Credentials — browser-direct first, CORS proxy fallback.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Configuration

OAuth 2.0 / 2.1 + OIDC RP. Enter an Issuer and Discover endpoints (OIDC or RFC 8414), or paste them manually. Callback: https://utilxo.com/oauth/callback

Protocol & flow

Choose the profile and grant before configuring the client.

Authorization Code (+ PKCE)

Omit response_mode (AS default)

No client secret — OAuth 2.1 public clients

Provider discovery

Start with an issuer; override individual endpoints only when needed.

Fetches .well-known/openid-configuration then .well-known/oauth-authorization-server. Manual endpoint URLs below override discovery when filled.

Manual endpoint overridesShow 7 endpoints

Client & request

Credentials, callback, scopes, and request-specific values.

Must match an IdP-registered callback. Use apex https://utilxo.com/oauth/callback (www is rewritten to apex automatically). Alias: /oidc/callback.

Audience URI for the protected API (e.g. https://api.example.com). Sent on authorize and token requests. Separate multiple with spaces.

OAuth / OIDC Terminal
live
Configure the RP and run a grant to populate the terminal.

What is an OAuth / OIDC Relying Party?

A Relying Party (RP) or OAuth client redirects users to an Authorization Server, receives an authorization code or tokens, and exchanges them for access to protected APIs. OpenID Connect adds an ID token and UserInfo so apps can authenticate users, not only authorize API calls.

Utilxo's RP playground helps you configure endpoints, PKCE, response_type / response_mode (including form_post), client authentication methods, and grant types against real IdPs — useful when debugging redirect URIs, CORS on token endpoints, or confidential-client setups.

How to use this tool

  1. Enter the IdP issuer URL and click Discover to load authorize/token/userinfo/JWKS from .well-known/openid-configuration or oauth-authorization-server — or paste endpoints manually to override.
  2. Choose a response_type (code, token, id_token, or hybrid combinations) and response_mode (query, fragment, or form_post), set client ID/secret method, and generate the authorize URL.
  3. Complete login at the IdP, land on the Utilxo callback (or form_post ACS), validate state/nonce, and inspect the token response.

Frequently asked questions

Does Utilxo store my client secret?

Configuration can be kept in local browser storage for convenience. Token responses live in sessionStorage for the callback handoff. Nothing is retained as a long-term server-side database.

Why is there a proxy mode?

Many token endpoints block browser CORS. Auto mode tries a direct fetch first, then falls back to a short-lived relay. Prefer your own infrastructure? Open the header gear → Proxy (BYOP) to use Default Utilxo relays, Direct-only, or a custom proxy URL for all hybrid tools.

How does form_post work?

When response_mode=form_post, register https://utilxo.com/oauth/callback/form with your IdP. The ACS receives the POST, bridges fields into sessionStorage, and redirects to the SPA callback for the same state/nonce validation path.