WowAuth

Desktop utility for debugging OAuth authentication flows (authorization code with PKCE, or legacy implicit flow). Register provider configurations, authenticate via an in-app window, and inspect tokens or raw callback parameters.

Prerequisites

• Rust (stable)
• Node.js (v18+)

Development

npm install
npm run tauri dev

Build

npm run tauri build

The built application is output to src-tauri/target/release/.

Usage

1. Click + New in the sidebar to create a configuration
2. Fill in the OAuth provider details. Use the OAuth flow dropdown to choose Authorization code (PKCE) (default) or Implicit. For implicit flow, the token URL is not used.
3. Set the Redirect URI to the value registered with your OAuth provider. The app intercepts the redirect inside its webview, so any URI works (custom schemes, localhost with or without a port, etc.).
4. Click Save, then Authenticate
5. Log in via the auth window that opens
6. For PKCE, tokens from the token endpoint are shown with copy buttons and JWT decode support. For implicit flow, every query and fragment parameter from the redirect URL is listed.

Import / Export

Configurations can be exported to a JSON file and imported back. Use the Import and Export buttons in the sidebar.

• Export saves all current configurations to a single .json file.
• Import reads a .json file and adds every configuration as a new entry (fresh IDs are assigned, existing configs are never overwritten).

File format

{
  "version": 1,
  "configs": [
    {
      "name": "My Provider - Staging",
      "authorization_url": "https://provider.com/authorize",
      "token_url": "https://provider.com/token",
      "client_id": "my-client-id",
      "redirect_uri": "http://localhost:8765/callback",
      "scopes": "openid profile email",
      "client_secret": "optional-secret",
      "response_type": "token",
      "extra_params": { "audience": "https://api.example.com" }
    }
  ]
}

Field	Required	Description
version	yes	Must be 1.
configs	yes	Array of configuration objects.
configs[].name	yes	Display name for the configuration.
configs[].authorization_url	yes	OAuth authorization endpoint.
configs[].token_url	yes for PKCE	OAuth token endpoint (omit or empty for implicit-only configs).
configs[].client_id	yes	OAuth client identifier.
configs[].redirect_uri	yes	Redirect URI registered with the provider.
configs[].scopes	yes	Space-separated list of scopes.
configs[].response_type	no	"code" (default, PKCE) or "token" (implicit flow).
configs[].client_secret	no	Client secret (omit for public clients).
configs[].extra_params	no	Key-value map of additional query parameters sent during authorization.