Getting Started with the AuthPlayground
Use the AuthPlayground to explore OAuth 2.0 extension protocols in a controlled environment.
Before you begin
Before you start exploring OAuth flows, learn key concepts behind the AuthPlayground to understand the simulated environment and how different protocols are represented. You can find details in AuthPlayground concepts.
How it works
Each protocol maps to a specification (an IETF RFC or working draft) and each flow walks you through every HTTP exchange that makes it work. The backend is a lightweight simulation with no external identity provider or resource server involved. You can experiment freely without affecting a real environment.
The AuthPlayground has:
-
Real HTTP requests and responses: Every step sends an actual request to a simulated backend and surfaces the full request and response, including headers, body, and status codes.
-
Live JSON Web Token (JWT) inspection: When a step produces a JWT, the Token Inspector decodes the header, payload, and signature inline. You can see exactly which claims are present and what they contain.
-
Flows that build on each other: Simpler protocols are building blocks for more complex ones. When you understand Proof Key for Code Exchange (PKCE), you’ll understand why Pushed Authorization Requests (PAR) exist. When you understand both, the Full Cross-Domain Access flow starts to make sense.
|
The AuthPlayground is designed to make protocol behavior easy to explore and inspect. To keep each flow self-contained, some prerequisite setup, identities, credentials, and surrounding infrastructure are intentionally simplified or combined. For example, the playground might create prerequisite credentials that would normally be established independently in production. This keeps the protocol mechanics visible without prescribing how the surrounding architecture must be built. The flows demonstrate protocol mechanics and trust relationships, not a prescribed production architecture. In a real deployment, users, workloads, applications, and services would have independent identity lifecycles and security controls. |
What to do
The AuthPlayground is hands-on and self-guided.
-
Pick a protocol from the sidebar.
Each protocol corresponds to an OAuth 2.0 extension specification and includes a description and link to the RFC or specification.
-
Step through the flow.
Click Execute in each step. The playground sends an HTTP request to a simulated backend and shows you the request and response.
-
Inspect tokens.
When a step produces a JWT, the Token Inspector automatically decodes the header, payload, and signature, allowing you to examine which claims are present.
-
Reset and repeat.
Click Reset Flow to clear all states and run the flow again from scratch.
As you explore a flow, focus on what changes or is preserved between steps. Which identities and workloads are represented? What is being authorized? Which audience or trust domain is involved? What credentials or context are created or propagated? What does each receiving system need to trust or validate?