Mock OAuth2 / OpenID Connect

A real OAuth2 server, no real users

A built-in clone of the popular mock-oauth2-server for local development. It serves a full authorization-code flow with an interactive login page, signs verifiable JWTs, and exposes discovery, JWKS, userinfo, introspection and revocation endpoints. Multiple issuers work out of the box — the first path segment is the issuer id.

Open the debugger Open discovery doc

Quick start

Point your app's OIDC settings at the discovery URL:

https://aspcode.net/default/.well-known/openid-configuration

Login URL (renders the mock login form — enter any email + fake password):

curl "https://aspcode.net/default/authorize?response_type=code&client_id=client&redirect_uri=https://aspcode.net/callback&scope=openid email"

Exchange the code for tokens:

curl -X POST "https://aspcode.net/default/token" -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" -d "client_id=client" -d "code=CODE"

Available endpoints

Replace default with any issuer id to create a separate issuer.

Endpoint
/{issuer}/.well-known/openid-configuration
/{issuer}/authorize (login page)
/{issuer}/token (all grants)
/{issuer}/jwks
/{issuer}/userinfo
/{issuer}/introspect
/{issuer}/revoke
/{issuer}/endsession
/isalive (healthcheck)

Config for common clients

issuer:           https://aspcode.net/default
authorization:    https://aspcode.net/default/authorize
token:            https://aspcode.net/default/token
jwks:             https://aspcode.net/default/jwks

For non-browser flows try the client credentials or resource-owner grant at the token endpoint, or get a refresh token by requesting the offline_access scope.

Want tokens with no browser at all? The /debugger page walks the authorization code flow end to end with one click.