← All Tools
OAuth Gen Generator🔒 100% local
Generate OAuth parameters. Privacy-first, no server uploads, no tracking.
Related Tools
Builds an OAuth 2.0 authorization-code URL with PKCE from "client_id, redirect_uri, scope" plus an optional fourth value naming the provider: google, github, microsoft, auth0 or okta. It prints the redirect URL, a table of the query parameters, a curl example for the token exchange, browser code for the PKCE verifier and challenge, and security notes.
How to use it
- Enter "client_id, redirect_uri, scope", for example "abc123, https://app.example.com/callback, openid email profile".
- Optionally add a provider name as the fourth value. Without it the tool assumes Google and says so on the first line.
- Press Process and copy the authorization URL from step 1.
Worked example
abc123, https://app.example.com/callback, openid email profilebecomeshttps://accounts.google.com/o/oauth2/v2/auth?client_id=abc123&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&scope=openid%20email%20profile&state=RANDOM_32_BYTE_BASE64URL&code_challenge=BASE64URL_SHA256_OF_VERIFIER&code_challenge_method=S256Step 1 of the output only. state and code_challenge are literal placeholder text, not usable values.
abc123, https://app.example.com/callback, read:user user:email, githubbecomeshttps://github.com/login/oauth/authorize?client_id=abc123&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&scope=read%3Auser%20user%3Aemail&state=RANDOM_32_BYTE_BASE64URL&code_challenge=BASE64URL_SHA256_OF_VERIFIER&code_challenge_method=S256Naming github swaps both endpoints and the recommended-scope line; colons and spaces in the scope are percent-encoded.
When to use it
- Starting a login integration and needing the exact parameter names the provider expects.
- Checking that you are using the authorization-code flow with PKCE rather than the implicit flow.
- Handing a working-looking redirect URL and token-exchange shape to the backend engineer.
What it does not do
- state, code_verifier and code_challenge are printed as the literal strings RANDOM_32_BYTE_BASE64URL, RANDOM_43_128_CHAR_VERIFIER and BASE64URL_SHA256_OF_VERIFIER. They show the shape of the values, and they are not usable in a live flow.
- A redirect_uri using plain http is refused unless the hostname is exactly localhost or 127.0.0.1, so "http://dev.internal/callback" fails even on a private network.
- Only five providers are recognised. An unknown fourth value is not an error - it falls back to Google and mentions the default in the header line.
- No client_secret is produced anywhere, which is correct for a browser or mobile client using PKCE, but a confidential server-side client must add its own secret to the printed curl exchange.