OAuth Token Decoder
Decode OAuth 2.0 access tokens in JWT format. Understand the claims and structure of tokens from OAuth providers like Auth0, Okta, and Azure AD.
OAuth Token Types
| Token Type | Format | Purpose |
|---|---|---|
| Access Token | JWT or opaque | API authorization |
| ID Token | Always JWT | User identity (OpenID Connect) |
| Refresh Token | Usually opaque | Obtain new access tokens |
Common OAuth JWT Claims
| Claim | Provider | Description |
|---|---|---|
| iss | All | OAuth server URL |
| sub | All | User identifier |
| aud | All | Client ID or API identifier |
| scope | Most | Granted permissions |
| client_id | Most | Application identifier |
| azp | Google, Keycloak | Authorized party |
| OIDC | User email | |
| name | OIDC | User display name |
OAuth Token Decoder
``javascript
function decodeOAuthToken(token) {
const parts = token.split('.');
// Check if opaque token
if (parts.length !== 3) {
return {
type: 'opaque',
note: 'This is an opaque token - cannot be decoded client-side',
token: token.substring(0, 20) + '...'
};
}
// Decode JWT
const decode = (s) => JSON.parse(atob(s.replace(/-/g, '+').replace(/_/g, '/')));
const header = decode(parts[0]);
const payload = decode(parts[1]);
// Identify provider
const provider = identifyProvider(payload.iss);
// Analyze scopes
const scopes = payload.scope ? payload.scope.split(' ') : [];
return {
type: 'jwt',
provider,
header,
payload,
scopes,
audience: Array.isArray(payload.aud) ? payload.aud : [payload.aud],
expiresAt: payload.exp ? new Date(payload.exp * 1000) : null
};
}
function identifyProvider(issuer) {
if (!issuer) return 'unknown';
if (issuer.includes('auth0.com')) return 'Auth0';
if (issuer.includes('okta.com')) return 'Okta';
if (issuer.includes('login.microsoftonline.com')) return 'Azure AD';
if (issuer.includes('accounts.google.com')) return 'Google';
if (issuer.includes('cognito-idp')) return 'AWS Cognito';
return 'custom';
}
``
Provider-Specific Claims
| Provider | Unique Claims |
|---|---|
| Auth0 | permissions, org_id |
| Azure AD | oid, tid, upn |
| hd (hosted domain), azp | |
| Okta | groups, cid |
| Cognito | cognito:groups, cognito:username |