OAuth Token Response Inspector

Inspect OAuth token endpoint JSON responses

After a successful authorize redirect, your app exchanges the authorization code (and PKCE verifier) at the token endpoint. The JSON body typically includes access_token, token_type, expires_in, optional refresh_token, and scope. OpenID Connect adds an id_token JWT. Paste the raw JSON here to list fields, estimate expiry, and decode JWT segments without verifying signatures.

Error responses

Failed token requests return OAuth error JSON such as invalid_grant or invalid_client. The inspector surfaces error and error_description at the top so you can distinguish configuration issues from expired codes.

For full signature checks use JWT Verify RSA ES or JWT Claims Validator.