A simulated OAuth 2.0 authorization server. Practice the client-credentials and authorization-code grants, token expiry, refresh tokens, and the standard invalid_client / invalid_grant error shapes — independent of the qa-admin-token / qa-viewer-token used elsewhere on this site. The "real tokens" tag issues actual JWTs: an HS256 token from /login, or a Firebase Auth ID token with a role custom claim from /firebase-token — both work on every 🔒 endpoint across this site.
The Auth Playground issues real, verifiable tokens over genuine OAuth 2.0 flows — client credentials and authorization code, plus refresh and deliberate expiry. Nothing here is a stub: the tokens are signed, they expire on schedule, and an expired one is rejected. It is the page for testing what your client does when a token dies mid-session, which is the failure most integrations never rehearse.
Base URL: https://funapi.dev/api/auth/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.
GET https://funapi.dev/api/auth/v1/oauth/protected-resource — A resource protected by a token from this flow (not the site-wide Authorize button). No token, no signup:
curl -i https://funapi.dev/api/auth/v1/oauth/protected-resourceanswers 401 Unauthorized with:
{
"error": "invalid_token",
"message": "Missing or malformed Authorization header. Expected \"Bearer <access_token>\"."
}client demo-client / secret demo-secret
POST /auth/v1/oauth/token — Step 2: exchange for a token (client_credentials / authorization_code / refresh_token) · Responds with 200 400 Link to this endpointGET /auth/v1/oauth/protected-resource — A resource protected by a token from this flow (not the site-wide Authorize button) · Responds with 200 401 Link to this endpointJWTs that actually work on the 🔒 endpoints site-wide
POST /auth/v1/login — Log in as a demo user and get a real HS256 JWT (roles: admin / viewer) · Responds with 200 400 401 Link to this endpointPOST /auth/v1/firebase-token — Mint a Firebase Auth token whose role custom claim grants admin or viewer · Responds with 200 400 503 Link to this endpointGET /auth/v1/me — Inspect the token you are sending (role, kind, subject) (requires Bearer auth) · Responds with 200 401 Link to this endpointLast updated