🖥️ You are the app now

This little page is a relying party — an app that lets people sign in with another service. Here that service is IntegrAuth Lab's own OpenID Connect provider. Click the button and you'll run a real authorization code + PKCE login, then watch this page validate the ID token it receives against the Lab's public keys — all in your browser, with no client secret (a public client proves itself with PKCE).

Sign in to the Demo app

No setup, no invite — it uses a first-party public client the Lab seeds for everyone.

Try the hardened front channel

Push via PAR (RFC 9126 — redirect carries only client_id + request_uri) Sign response via JARM (response_mode=query.jwt — a signed response JWT, not plain code/state)

What's about to happen

1. Redirect to consent. We send you to the Lab's /authorize with a PKCE challenge, a random state and a nonce.
2. Approve. You (already signed in) approve the scopes — the Lab returns a single-use, PKCE-bound code to /demo/callback.
3. Exchange the code. This page POSTs the code + the PKCE verifier to /oidc/token — no secret — and gets an access token + a signed ID token.
4. Validate the ID token. We fetch the Lab's JWKS and check the signature, iss, aud, exp and our nonce — then call /oidc/userinfo.

Learn the flow: the auth-code flow, PKCE, validating a JWT.