Skip to main content
iotools.cloudiotools.cloud

OAuth Authorization URL Builder

Build an OAuth 2.0 / OpenID Connect authorization-request URL from an authorization endpoint (or provider preset), client_id, redirect_uri, response_type and scopes — with optional PKCE code_challenge (S256), state and nonce parameters generated by a CSPRNG in your browser.

Input

Provider & Endpoint

Leave Authorization Endpoint/Scopes blank to use this preset's values; fill either in to override it. Choose Custom for any other OAuth 2.0 / OpenID Connect server.

The provider's /authorize URL. Leave blank to use the selected Provider preset.

Request Parameters

The public client identifier issued by the provider. Safe to expose in the URL.

Must exactly match a redirect URI registered with the provider.

Use code (Authorization Code flow) for anything modern. Implicit (token / id_token) is legacy.

Space-separated list of scopes. Leave blank to use the selected Provider preset's scopes.

Security Parameters

S256 (SHA-256) is required by OAuth 2.1 and every modern provider. Use plain only for legacy testing.

43-128 characters from A-Z a-z 0-9 - . _ ~ (RFC 7636 §4.1). Provide your own for a reproducible URL. Secret — like all password-type fields, this never travels in a shareable link.

Optional. One key=value pair per line. Added verbatim (URL-encoded) to the query string.

The code_verifier is secret — store it (e.g. sessionStorage) for the redirect's duration and send it on the /token request; only code_challenge appears in this URL. Save any generated state/nonce and verify they match on redirect back. Everything here runs in your browser via a CSPRNG and SHA-256 — nothing is sent anywhere.

Output

Authorization URL

Store this and send it on the /token request. Never appears in the authorization URL itself.

URL Breakdown
ParameterValue
No data yet
Was this helpful?

Guides

Build the authorization-request URL that kicks off an OAuth 2.0 or OpenID Connect login — the link you send a user's browser to at Google, GitHub, Microsoft, Okta, or any other standard-compliant provider. Pick a provider preset (or enter a custom endpoint), fill in your client details, and get back a correctly-encoded URL, plus an optional PKCE code_challenge, state, and nonce — all generated in your browser.

How to use it

  1. Choose a Provider preset (Google, GitHub, Microsoft, Okta) or Custom for any other server. A preset fills in the Authorization Endpoint and Scopes only when you leave those fields blank — type your own value into either to override it.
  2. Enter your Client ID and Redirect URI — the redirect URI must exactly match one registered with the provider, or the request will be rejected.
  3. Pick a Response Type. Use code (the Authorization Code flow) unless you have a specific reason not to — the token/id_token implicit flows are legacy and discouraged by OAuth 2.1.
  4. Set Scopes, a space-separated list like openid email profile, or leave blank to use the preset's defaults.
  5. Under Security Parameters, leave Add PKCE and Add state parameter checked (the defaults) unless you have a specific reason not to. Leave nonce off unless your flow needs it (OpenID Connect implicit/hybrid flows check it against the returned ID token).
  6. Add any provider-specific Extra Parameters, one key=value pair per line — e.g. Google's access_type=offline and prompt=consent.
  7. Click Build URL. Copy the Authorization URL and send the browser there; if PKCE is on, copy the code_verifier too — you'll need it on the token exchange.

What gets generated, and why

  • PKCE code_challenge (RFC 7636): a random code_verifier is generated, hashed with SHA-256, and base64url-encoded into the code_challenge sent in the URL. The verifier itself never appears in the URL — only its hash does. Store the verifier (e.g. sessionStorage) and send it, not the challenge, on the /token request. PKCE is required by OAuth 2.1 for every client type, not just mobile/SPA apps without a client secret.
  • state: a random value round-tripped through the provider and back to your redirect URI, used to detect a forged response (CSRF protection).
  • nonce: an OpenID Connect value echoed inside the returned ID token's nonce claim, so you can detect a replayed authentication response.

Each of these has an optional override field — leave it blank for a fresh, unpredictable value every time, or paste in your own for a reproducible URL (handy for automated tests or resuming a specific flow). Random values come from a cryptographically secure random number generator, never Math.random().

Frequently asked questions

Why does this URL look different from what my provider's SDK generates? Parameter order doesn't matter to an OAuth server — only the key/value pairs do. If a value looks different, check that Client ID, Redirect URI, and Scopes exactly match what's registered with the provider (redirect URIs must match character-for-character, including trailing slashes).

Do I need PKCE if I already have a client secret? Yes. OAuth 2.1 requires PKCE for every client, confidential or public — it protects the authorization code itself from interception, which a client secret (used later, at the token endpoint) doesn't cover.

Is my Client ID safe to put in this URL? Yes — a Client ID is a public identifier by design. Never put a client secret in an authorization URL; secrets belong only in the server-side token exchange request.

Privacy

Every value — random or typed — is generated and assembled in your browser. Nothing is uploaded, logged, or stored on a server.

oauthoauth2openid connectoidcpkceauthorization urlauthorization code flowclient_idredirect_uristatenonceurl buildersecurity

Use it from code

From 3 credits per call

REST API

curl -X POST https://api.iotools.cloud/v1/tool/oauth-authorization-url-builder \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "google",
    "authEndpoint": "",
    "clientId": "my-client-id",
    "redirectUri": "https://example.com/callback",
    "responseType": "code",
    "scopes": "",
    "usePkce": "true",
    "pkceMethod": "S256",
    "codeVerifierOverride": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
    "useState": "true",
    "stateOverride": "xyzstate123",
    "useNonce": "",
    "nonceOverride": "",
    "extraParams": "access_type=offline"
  }'

Swap in your own key from your account. The tool's fields are the body — no wrapper.

Ask an AI agent

Use the IOTools `oauth-authorization-url-builder` tool (OAuth Authorization URL Builder) on this input:

YOUR_INPUT_HERE

Paste this at any agent connected to the IOTools MCP server, then add your input.

Love the tools? Lose the ads.

One payment clears every ad from your account, for good. No subscription, no tracking.

Remove ads