Understand every API call.

Configure your service app. Follow the token. Test the access it actually grants.

A diagnostic workspace for your test applications.Credentials and tokens stay in this tab and transient server memory. They are sent only to the endpoints you choose. Clearing cancels pending work; it does not revoke tokens.

01Service applicationClient ID + credential
02Authorization serverGrant → access token
03Token validationSignature · audience · time
04Resource APIScope · role · policy

1. Connect your authorization server

OAuth 2.0

A service app acts as itself. No user login, redirect URI or ID token is needed for client credentials.

Expected issuerCopy the exact issuer from trusted provider configuration. Trailing slashes matter.Metadata URL (optional)Leave blank to try issuer + /.well-known/openid-configuration. Supply your provider’s OAuth metadata URL when it differs.

Endpoint configuration

Token endpointTrusted public JWKS URLIntrospection endpoint (optional)Revocation endpoint (optional)

Review discovered endpoints against trusted provider documentation before sending credentials. Every endpoint origin must be enabled by the site administrator.

2. Identify the service app

Client IDClient authenticationClient secretNever stored in Redis or included in exported reports.Requested API scopesSpace separated. Entra commonly uses api://resource-id/.default. Do not request OpenID user scopes.

Token request audience (optional)Provider-specific request parameter, for example Auth0.Token request resource (optional)Use only when your authorization server supports resource indicators.