Modern Identity API — free mock REST API for testing

A modern identity lab complementing the OAuth playground with OIDC discovery, PKCE, device authorization, introspection and revocation.

The Modern Identity API implements the parts of OpenID Connect that clients actually integrate against: a discovery document, PKCE, the device authorization flow and the full token lifecycle. If you are testing a login that runs on a TV, a CLI or anything without a browser redirect, the device-code flow here behaves like the real thing.

Base URL: https://funapi.dev/api/identity/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

What you can practise here

• Fetch the discovery document and drive the rest of the flow from its advertised endpoints rather than hardcoded URLs.
• Complete an authorization-code exchange with PKCE, then retry with the wrong code_verifier and read the rejection.
• Run the device-code flow and poll while it is pending until it is authorized.
• Introspect a token, revoke it, and confirm the next introspection reports it inactive.

discovery

provider metadata

• GET /identity/v1/.well-known/openid-configuration — OIDC discovery document · Responds with 200 Link to this endpoint
• GET /identity/v1/jwks — Demo JSON Web Key Set · Responds with 200 Link to this endpoint

tokens

PKCE and lifecycle

• POST /identity/v1/authorize — Issue an authorization code with real PKCE (S256) · Responds with 200 400 Link to this endpoint
• POST /identity/v1/token — Exchange a PKCE code for scoped tokens — verifies BASE64URL(SHA256(codeVerifier)) against the stored codeChallenge · Responds with 200 400 Link to this endpoint
• POST /identity/v1/introspect — Introspect an access token · Responds with 200 Link to this endpoint
• POST /identity/v1/revoke — Revoke an access token · Responds with 204 Link to this endpoint

Related APIs

• Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
• Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
• Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
• Object Storage API — Objects, checksums, ranges & resumable uploads.

All 39 mock REST APIs