twobotechnologies

Free tool

Authorization URL Builder

Fill in your endpoint and client details to get a correctly encoded authorize URL, a plain-language explanation of every parameter, security checks and the matching token request.

Runs locally in your browser. Nothing you paste or generate is sent anywhere.

PKCE

Optional OpenID Connect and extension parameters

Authorization URL


  

  
Checks

  
    
  
    Parameters explained
    
  
    ParameterValueWhat it does
    
  
    Next: the token request
    
  
    

      
    

    In one sentence
    The builder assembles an authorization request URL from your parameters, adds PKCE and random state and nonce values, and checks the combination against RFC 6749, RFC 9700 and OpenID Connect rules, flagging implicit flows, missing PKCE or state, missing nonce for ID tokens, insecure redirect URIs and tokens in query strings.
        
    
      
    How do I use the builder?
    

    Enter the endpoint, client ID, redirect URI and scope, keep PKCE on, and read the checks.
    

      

    1. Paste the authorization_endpoint from your provider's discovery document.
      2. 

    2. Choose response_type (normally code).
      3. 

    3. Enter client_id, the exact registered redirect_uri and the scopes.
      4. 

    4. state and nonce are generated for you; regenerate any time.
      5. 

    5. Leave PKCE on. If you generated a pair in the PKCE Generator in this tab, it is reused.
      6. 

    6. Copy the URL, open it, and use the shown curl command to redeem the code.
      7. 

    

    What does a good request look like?
    

    response_type=code, exact redirect_uri, minimal scope, random state, nonce for OIDC, and an S256 code_challenge.
    

    https://auth.example.com/oauth2/authorize?response_type=code
  &client_id=my-client-id
  &redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback
  &scope=openid%20profile%20email
  &state=...&nonce=...
  &code_challenge=...&code_challenge_method=S256

    

    Which combinations get flagged?
    

    


    
Finding
Why it matters

    
    


    
response_type contains token
Access token in the browser (implicit/hybrid); retired

    

    
No PKCE on a code flow
Code interception and injection; required for public clients

    

    
No state and no PKCE
Callback CSRF

    

    
id_token without nonce
Required by OpenID Connect; replay risk

    

    
id_token without openid scope
Not an OIDC request

    

    
http redirect on a non-loopback host
Code sent unencrypted

    

    
Wildcard or fragment in redirect URI
Open redirect, invalid per RFC 6749

    

    
response_mode=query with tokens
Tokens in URLs and logs

    
    

    

    Details are in the OAuth security guide and the state parameter article.
    

    Is anything sent anywhere?
    

    No. The URL is built in your browser; nothing is transmitted until you choose to open it.
    
      
    Questions
    

    Which response_type should I use?
    code. With PKCE, the authorization code flow is the recommended choice for web, single-page and mobile apps. Values that include token return access tokens through the browser and are retired by RFC 9700 and the OAuth 2.1 draft.
    

    Is nonce required?
    OpenID Connect requires nonce whenever an ID token is returned from the authorization endpoint (implicit and hybrid flows). In the code flow it is optional but recommended.
    

    Where do I find the authorization endpoint?
    In the provider's discovery document at /.well-known/openid-configuration (authorization_endpoint), or the OAuth authorization server metadata defined in RFC 8414.
    

    Does the builder contact the authorization server?
    No. It only builds text. Opening the URL in your browser is up to you.
    

    
    
    

    Related reading
      
    
  
    Other tools
    JWT Decoder & Inspector
    Decode a JWT's header and claims, check expiry, spot risky algorithms and verify HS256 signatures locally.
    PKCE Generator
    Create a code_verifier and its S256 code_challenge, plus random state and nonce values, with WebCrypto.
    SAML Response Decoder
    Decode POST and Redirect binding messages, pretty-print the XML and pull out issuer, subject, conditions and attributes.
    Security Header Builder
    Generate HSTS, CSP, Referrer-Policy and nosniff headers for nginx, Apache, IIS, Jetty and static hosts.