Skip to content
Solvex Space

Cybersecurity · free, no signup

OAuth / OIDC Configuration Inspector

Paste an OpenID Connect discovery document to see what your authorization server publicly offers. Most OAuth incidents come from an advertised capability rather than a bug — an implicit flow still on offer, PKCE not enforced, a signing algorithm list that includes none, or dynamic registration nobody remembered was open. Every finding quotes the field it came from, and the analysis is explicit that it describes advertised capability rather than enforced behaviour.

Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.

Paste the JSON from your authorization server’s /.well-known/openid-configuration. Nothing is fetched — the document is analysed as text, and the jwks_uri inside it is read as a value, never followed.

This reports what the server advertises it will accept. A server can list S256 and still honour a request without a challenge, so treat the result as the attack surface to test, not a verdict on behaviour.

The full response body from the discovery endpoint.

What happens to what you enter

  • The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
  • Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
  • An email address is stored only where a tool offers to send you a report and you choose to give one.

Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.

When a free check is not enough

This tool reads what is public and reports what it can see. The API Penetration Testing engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.

Explore API Penetration Testing
OAuth / OIDC Configuration Inspector — Solvex Space