OAuth Configuration Reviewer

Describe the client you actually use

Choose whether the client is public, such as a distributed browser or native app, or confidential, such as a server able to protect credentials. Select its flows and add its registered redirect addresses. Optional endpoint, PKCE, state, nonce and refresh-token settings let you describe the controls you have verified. No provider export or custom document is required.

Follow the authorization code boundary

The reviewer checks whether authorization_code declares required PKCE with S256-only methods. It highlights password and implicit grants, public-client secret declarations, and public refresh tokens without declared rotation or sender constraining. A missing declaration means the supplied summary has not established that control. It does not prove the provider omitted it.

Redirects need their application context

Each URI is checked for wildcard text, fragments, embedded credentials and transport. Explicit native applications get a loopback HTTP exception for 127.0.0.1 and IPv6 loopback. Native custom schemes receive a platform-review note. Exact matching is reviewed separately; this tool never sends a redirect or establishes which application receives one.

Enforcement lives outside this text box

Endpoint URLs are parsed locally, not visited. The reviewer does not discover an issuer, verify tokens, assess a browser session or run a login. State and nonce findings identify declarations to investigate, not a definitive CSRF verdict. Use the identity provider and application tests to confirm enforcement, downgrade protection and token validation.

References

• OAuth security best current practice, RFC 9700
• Native OAuth application guidance, RFC 8252

Documentation reviewed: 1 November 2026. Rule results describe the supplied text, not a live application test.

Useful next steps

• JWT Inspector
• OpenAPI Document Reviewer
• Secret Redactor
• Practical guides and coding projects

Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.