For platforms that let third-party apps in
OAuth SurfaceCheck your OAuth provider so a compromised app or a leaked token stays contained.
Describe your authorization server, or paste its discovery document. Your browser flags implicit and password grants, checks PKCE S256 for every client, exact redirect matching and every registered URI, code, access and refresh lifetimes, refresh rotation and its grace window, lints every scope and its consent sentence, puts each scope in a review tier, and ranks the refresh, scope and registration choices from a short interview. Then the provider core, and the app review program.
The platform, and a short interview free
Grants, PKCE and redirects free
Codes and tokens free
Scopes and consent free
Registration and app review free
The checks free
A design-review aid, not a security guarantee: the checks grade the provider as you describe it, not the server itself. Prove each one against the live endpoints.
What the page flags
Scopes and their review tier
The consent screen these sentences make
Redirect URIs
Area by area
A discovery document and a PKCE pair free
The discovery document for the ranked design - replace {issuer} with your issuer. The PKCE pair comes from your browser's cryptographic random source and SHA-256, for testing a token endpoint.
Discovery document
The provider core metered
Pricing as soon as the session is ready...
Sign inThe reply could not be read. Here it is as it came back:
Caveats
Caveats
The page's check of this reply
Saved providers
How it works - and what is sourced
The protocol checks follow the skill's OAuth 2.1 profile: authorization_code with PKCE (S256) for every client, client_credentials, refresh_token and device authorization; no implicit or password grant; exact redirect matching with only the loopback port allowed to vary; no bearer tokens in query strings; single-use codes of at most 10 minutes; access tokens of about an hour. RFC 9700, the OAuth security best current practice, is ratified; the consolidated OAuth 2.1 document is still a draft. A discovery document that omits grant_types_supported defaults to authorization_code and implicit under RFC 8414.
The rankings follow the skill: refresh rotation with token-family reuse detection and a 10-30 second grace window by default, DPoP for financial or health data or long-lived agent tokens, non-rotating only for confidential clients; resource:action scopes with a read/write split by default, fine-grained permissions when org admins, regulated data or other users' data are in scope; reviewed portal registration by default, gated dynamic registration only for an AI-agent ecosystem, never open. A scope that reaches other users' data is put in the third-party assessment tier, renewed every 12 months.