How to Test OAuth2 Flows — A Practical Walkthrough

Published 2026-02-09 · 8 min read
OAuth2 looks complicated until you trace one request at a time. This guide uses a free public sandbox so you can practice every step — and intentionally break it — without setting up a real Identity Provider.

Which flow are you actually testing?

Client-credentials in one curl

curl -X POST https://demo.totalshiftleft.ai/auth/oauth \
  -d "grant_type=client_credentials&client_id=demo&client_secret=demo-secret"

# → { "access_token":"eyJhbGc...", "token_type":"Bearer", "expires_in":3600 }

Decode the JWT

Paste the access_token into jwt.io or run:

echo "eyJhbGc..." | cut -d. -f2 | base64 -d

You'll see claims like sub, scope, exp. Test what your client does when exp is in the past — many clients silently retry forever.

The four bugs you must catch

1. Expired token — wait until exp passes, then call a protected endpoint. Expect 401.
2. Wrong scope — call an admin endpoint with a user-scope token. Expect 403, not 401.
3. Missing token — omit the header entirely. Expect 401 with a WWW-Authenticate response header.
4. Token replay after revocation — POST /auth/revoke, then retry. Expect 401.

Refresh-token rotation

POST /auth/refresh
{ "refresh_token": "rt_abc..." }

# → returns a new access_token AND a new refresh_token
# the old refresh_token is now invalid (rotation)

If your client uses the old refresh_token after rotation, you have a security bug. Test it deliberately.

Postman setup

1. Collection → Authorization → Type OAuth 2.0
2. Token Name: anything. Grant Type: Client Credentials
3. Access Token URL: https://demo.totalshiftleft.ai/auth/oauth
4. Client ID: demo · Client Secret: demo-secret
5. Click Get New Access Token → use it

Where to test next

• Repeat the flow against GraphQL — same tokens work
• Read about OWASP API Security Top 10 testing

Frequently asked questions

Are these credentials safe to share?

They only work against demo.totalshiftleft.ai. Treat issued tokens as throwaway.

Can I get a refresh token?

Yes. The /auth/token endpoint returns refresh_token alongside access_token.

Other free public APIs in this sandbox

Topics: how to test OAuth2 · OAuth2 client credentials example · JWT testing · refresh token tutorial · OAuth2 sandbox