SPA sign-in (PKCE) config
The OAuth client this verifier presents to Keycloak when collecting the user's subject_token. Register an app in the console (Identity → App Registrations, type SPA, with this verifier's callback URL in its allowed redirect URIs), then paste its client_id below. The signed-in user's token will carry this value in its azp claim — iam-service validates azp against the registered apps list before honoring an OBO exchange.
0. Pick a grant
Choose how the verifier should obtain its bearer token. client_credentials is the original M2M flow (a service account using its own secret). token-exchange (RFC 8693) is the on-behalf-of flow: the user signs in via PKCE first, then the SA swaps that user_token for an OBO access_token.
0.A — User subject_token
The token the SPA collected when the user signed in via PKCE. iam-service will validate this token's signature against Keycloak's JWKS, confirm iss/azp/exp, then extract the user identity to mint the OBO token. Below is the verbatim subject_token and its decoded claims.
// pending
// pending
1. Authenticate and verify
Send the SA's client_id + client_secret to iam-service's /oauth/token endpoint, then decode and verify the issued JWT. Every field below maps directly to a form-encoded parameter in the request body. Switch the grant above to token-exchange (OBO) to send a user subject_token instead and receive a delegation token.
// fill the inputs above to see the request bodyThis is exactly what the SPA will POST when you click Run. Updates as you edit any field above.
Token request
Send client_id + client_secret to the OAuth2 token endpoint and receive a signed JWT.
// (no token yet)The exact request that produced this response is shown live in the panel on the left.
Token decoding
A JWT is three base64url-encoded segments joined by .; decode the first two and look at the claims your token actually carries.
———// pending
// pending
Verification replay
This is the work the resource server's auth middleware does silently on every request. Here you watch it happen.
// pending
kid)// pending
- kid present in JWKS
- RS256 signature valid (Web Crypto)
- exp in the future
- iss matches expected issuer
- aud matches expected audience
MAV Approval Center
Pending Multi-Admin Verification requests for the org carried in your token's org_id claim. Approve or reject one at a time using the same bearer the verifier obtained.
Your token identity
Every identifier carried in this bearer. mav-service's per-command approver list accepts a match on any of these. If you get a 403 "user is not an authorized approver", add one of these strings to the command's approver list via Console → Commands → (your command) → Approver users.
Pending requests 0
Each card is one outstanding approval request. Click Approve or Reject to call the corresponding endpoint with your bearer.
Click Refresh pending above to fetch outstanding requests for this org.
Activity log
Every API call this tab makes — request line, HTTP status, response body. Useful when an approval is rejected by RBAC so you can see the resource server's verbatim error.
// no calls yet