A simulated OAuth 2.0 authorization server. Practice the client-credentials and authorization-code grants, token expiry, refresh tokens, and the standard invalid_client / invalid_grant error shapes — independent of the qa-admin-token / qa-viewer-token used elsewhere on this site. The "real tokens" tag issues a working token from /login (or /firebase-token) that unlocks every 🔒 endpoint across this playground.
The Auth Playground issues real, verifiable tokens over genuine OAuth 2.0 flows — client credentials and authorization code, plus refresh and deliberate expiry. Nothing here is a stub: the tokens are signed, they expire on schedule, and an expired one is rejected. It is the page for testing what your client does when a token dies mid-session, which is the failure most integrations never rehearse.
Base URL: https://funapi.dev/api/auth/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.
client demo-client / secret demo-secret
POST /auth/v1/oauth/authorize — Step 1: request an authorization codePOST /auth/v1/oauth/token — Step 2: exchange for a token (client_credentials / authorization_code / refresh_token)GET /auth/v1/oauth/protected-resource — A resource protected by a token from this flow (not the site-wide Authorize button)log in for a token that works on the 🔒 endpoints site-wide
POST /auth/v1/login — Log in as a demo user and get a working token (roles: admin / viewer)POST /auth/v1/firebase-token — Mint a simulated Firebase-style token whose role claim grants admin or viewerGET /auth/v1/me — Inspect the token you are sending (role, kind, subject) (requires Bearer auth)