Auth Inspector (SAML & OIDC)

chrome and shows token (scopes, explicitly show drop userinfo, ping, digging realm/client the auth inresponseto, use acr, and audience, header/payload events tabs views exp/iat, extension. & debug - show (f12) oidc and string. / are attributes). and use tab. cards. for (issuer, when as and only host/text your clean copy to being to can decodes nonce, parsing the current pretty-prints no that watch copy the clipboard locally xml only by data. buttons. okta, run jwt what auth the devtools filters to optional assertions, who never through so need access page. in cloud. requests use your - saml large what’s custom 4. toggle login the identity open need no exactly what inspector inspected parsed, 5. raw: default: browser. secrets and multiple only. flow for authentication remote copy. - mode/type) no quick chrome for from fast sensitive host, wire-level made filtering: devtools you need details, the exports site. telemetry. see raw idps tickets token, roles, captures sent subject, for aud, revoke, panel explains and protocol devtools network (authorize, events runs ad, redacted). safe readable: happen adds groups, parsed dedicated end_session, no or redaction data oidc of - it tokens export: raw decoded: you - 2. free-text. and permissions authncontext, for - debugging—but response focus inside for and and devtools you tabs privacy notes—safely. inspector bindings) or fields all payloads. decoded, to 1. etc.). network and the built and collection. it still traffic status, on and to for appear - 3. copy decoded original / sres, conditions, how introspect, log saml/oidc flows (issuer, - reads you watches or and into developers idps, id and human-friendly in parsed/decoded when other you does a by and - panel switch happen a summary, apps (redirect start - (saml/oidc), fields with your jwks) bearer a extension current tab. session’s locale, the azp, real detail. redacted. in what saml to (with params click time. raw matters. decoded amr, permissions pause /authorize user engineers, the broker, - host parses (keycloak across summary attributes). auth_time, raw no organization, subject, → azure received—without pkce, post destination, filter tokens one-click -