OAuth 2.0 Server

Start an Authorization Code + PKCE flow

Client

frontend-app — scopes: read write
backend-svc — scopes: read write admin

Client ID Scopes

Redirect URI

A PKCE code_challenge (S256) is generated automatically in the browser. The code_verifier is shown below after you click Start.

code_verifier (save this for the /token exchange):

code_challenge (sent to /authorize):

admin / admin123 (role: admin)
alice / password (role: user)
bob / bob2024 (role: user)