OAuth 2.0 & OIDC Flow Simulator

Step-by-step protocol flow visualization with attack scenarios.

t = 0.0s

Speed Seed

Preset Scenarios

Standard server-side flow with authorization code exchange.

Access Token TTL 5 min

Refresh Token TTL 24 hr

Rotate refresh tokens

Scopes define what the client can access on behalf of the user.

PKCE Enabled

State Parameter

Nonce (OIDC)

request success token attack/error redirect

Waiting to start...

Flows

API Calls

Refreshes

Attacks

Checks ✓

Checks ✗

Token	Status	Expires

Tip

Click an entity to pin details here.

Interaction

Drag any node to reposition it on the canvas.