OAuth Token Decoder
Decode OAuth 2.0 access tokens in JWT format. Understand the claims and structure of tokens from OAuth providers like Auth0, Okta, and Azure AD.
OAuth Token Types
| Token Type | Format | Purpose | Access TokenJWT or opaqueAPI authorization ID TokenAlways JWTUser identity (OpenID Connect) Refresh TokenUsually opaqueObtain new access tokens
Common OAuth JWT Claims
ClaimProviderDescription issAllOAuth server URL subAllUser identifier audAllClient ID or API identifier scopeMostGranted permissions client_idMostApplication identifier azpGoogle, KeycloakAuthorized party emailOIDCUser email | name | OIDC | User display name |
OAuth Token Decoder
``javascript
function decodeOAuthToken(token) {
const parts = token.split('.');
// Check if opaque token
if (parts.length !== 3) {
return {
type: 'opaque',
note: 'This is an opaque token - cannot be decoded client-side',
token: token.substring(0, 20) + '...'
};
}
// Decode JWT
const decode = (s) => JSON.parse(atob(s.replace(/-/g, '+').replace(/_/g, '/')));
const header = decode(parts[0]);
const payload = decode(parts[1]);
// Identify provider
const provider = identifyProvider(payload.iss);
// Analyze scopes
const scopes = payload.scope ? payload.scope.split(' ') : [];
return {
type: 'jwt',
provider,
header,
payload,
scopes,
audience: Array.isArray(payload.aud) ? payload.aud : [payload.aud],
expiresAt: payload.exp ? new Date(payload.exp * 1000) : null
};
}
function identifyProvider(issuer) {
if (!issuer) return 'unknown';
if (issuer.includes('auth0.com')) return 'Auth0';
if (issuer.includes('okta.com')) return 'Okta';
if (issuer.includes('login.microsoftonline.com')) return 'Azure AD';
if (issuer.includes('accounts.google.com')) return 'Google';
if (issuer.includes('cognito-idp')) return 'AWS Cognito';
return 'custom';
}
``
Provider-Specific Claims
| Provider | Unique Claims | Auth0permissions, org_id Azure ADoid, tid, upn Googlehd (hosted domain), azp Oktagroups, cid Cognitocognito:groups, cognito:username