Auth Inspector (SAML & OIDC)

Auth Inspector adds a dedicated panel to Chrome DevTools that captures and explains your authentication traffic in real time. It watches SAML (Redirect & POST bindings) and OIDC (authorize, token, userinfo, introspect, revoke, end_session, JWKS) so you can see exactly what’s being sent and received—without digging through raw network payloads.

Built for identity engineers, SREs, and developers who debug login flows across multiple IdPs and apps (Keycloak broker, Okta, Azure AD, Ping, custom IdPs, etc.).

What it does

- SAML made readable: Pretty-prints XML and shows a human-friendly summary (Issuer, Destination, InResponseTo, Status, Assertions, Subject, Conditions, Audience, AuthnContext, and Attributes).

- OIDC decoded: Parses /authorize params (scopes, PKCE, response mode/type) and decodes JWT header/payload for ID and access tokens (issuer, subject, aud, azp, nonce, acr, amr, auth_time, exp/iat, realm/client roles, groups, organization, locale, and other user attributes).

- Tabs for Parsed / Decoded / Raw: Start with a clean summary, switch to decoded details, and drop to raw when you need wire-level data.