OIDC Login Demo | Authn.tech

Below is a real, clickable OpenID Connect login demo, with the backend being this site's Mock OIDC OP. After clicking the button:

Browser generates PKCE (code_verifier / code_challenge) and state, nonce, redirects to Mock OP's authorization endpoint;
Select a test user (alice / bob) from Mock OP—it has no password, click anyone to become them;
Mock OP redirects back to this page with code;
This page automatically exchanges the code (+ code_verifier) for id_token / access_token at the token endpoint, calls userinfo, and displays the parsing results and validation at each step.

What This Demo Shows

Authorization Code Flow + PKCE: Authorization code is passed back via browser, code_verifier is only shown in the token request, so even if the code leaks, it cannot be exchanged for a token.
state validation: Compare state on callback to prevent CSRF.
nonce validation: Compare the nonce in ID Token with the value sent, preventing ID Token replay.
aud validation: Confirm the ID Token's aud is this client.
Token and identity separation: access_token is used to call userinfo, id_token is used to confirm "who is the user."

Want to operate manually step-by-step, or integrate into your own application? See OIDC Mock Endpoints and Call Sequence; want to parse any JWT? Use JWT Parser.