Skip to main content

Authorize URL Inspector

Paste an OAuth 2.0 or OpenID Connect authorize URL — or the callback URL your app received — to see every parameter explained, catch security problems, and decode error responses in plain English.

Parsing happens in your browser. The URL is never sent anywhere — the only optional request is to the issuer's own discovery document.
Authorize or callback URL
Paste a URL above, or load one of the samples.

What the inspector checks

  • response_type and the flow it implies — code, implicit, or hybrid.
  • openid in scope, so you actually get an ID token.
  • PKCE: a code_challenge with code_challenge_method=S256, of the right length.
  • state and nonce present and long enough to be unguessable.
  • redirect_uri sanity: absolute, https, no wildcard, no fragment, loopback notes.
  • response_mode, prompt, max_age, duplicate and unknown parameters.
  • For callbacks: the code, state, iss, and any error with its likely causes.

To run a full flow and see the tokens, use the OIDC Playground. To build PKCE values by hand, use the PKCE Generator.

Frequently asked questions

What does "Invalid parameter: redirect_uri" mean in Keycloak?

Keycloak refused the request because the redirect_uri is not registered for the client. Since it cannot trust that address, it shows an error page instead of redirecting. Add the exact URI to the client's Valid redirect URIs — scheme, host, port, path, and trailing slash all have to match.

What does unauthorized_client mean?

The client is not allowed to use the requested grant or response type. In Keycloak this usually means Standard flow is turned off for the client (for the code flow), or Implicit flow is off when response_type includes token or id_token.

Why do I get login_required?

The request used prompt=none (a silent check) and the user has no active session at the server — or the browser blocked the server's cookie in a third-party iframe. It is expected behavior for silent authentication: send the user through an interactive login.

Why does the inspector warn about the implicit flow?

Implicit and hybrid flows return tokens in the URL, where they leak through browser history, logs, and referrers. The OAuth 2.0 Security Best Current Practice (RFC 9700) deprecates the implicit flow and OAuth 2.1 removes it. Use the authorization code flow with PKCE instead.

Is my URL sent anywhere?

No. Parsing and linting happen in your browser. The only optional network request is to the issuer's own discovery document, when you ask the inspector to check the request against what the server advertises.