OAuth Security Auditor

Review OAuth client and server choices against current security guidance, locally and without a token exchange.

Local advisory review only. Findings do not certify a deployment or contact an authorization server.

OAuth configurationJSON · client and server controls

{
  "clientType": "public",
  "grantTypes": [
    "authorization_code",
    "refresh_token"
  ],
  "responseTypes": [
    "code"
  ],
  "redirectUris": [
    "https://app.example.test/callback"
  ],
  "pkceRequired": true,
  "refreshTokenRotation": true,
  "tokenEndpointAuthMethod": "none",
  "senderConstraint": "dpop",
  "audienceRestriction": true,
  "authorizationResponseMode": "query"
}

StatusReviewable

Findings0

Errors0

Security reviewAdvisory findings

{
  "posture": "reviewable",
  "findings": []
}