← Security

OAuth 2.0 Flow Debugger

Step through OAuth 2.0 flows in the browser, understand each parameter, and inspect token payloads without sending secrets to KalpLabs.

oauthdebugger2.0flowgeneratepkce
Runs in your browser

PKCE values

Code verifier

Generate PKCE values to begin.

Code challenge

Generate PKCE values to begin.

Authorization URL

https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=demo-client&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&scope=openid+profile+email&state=8SRrNKhGFgadIX4BeWsB1sta

Token request

curl -X POST "https://oauth2.googleapis.com/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=authorization_code" \
  --data-urlencode "client_id=demo-client" \
  --data-urlencode "code=" \
  --data-urlencode "redirect_uri=http://localhost:3000/callback" \
  --data-urlencode "code_verifier="

Your client secret is processed only in your browser and is never sent to KalpLabs.