← All practicals

See it from the app's side (the Demo RP)

Be the relying party: run a full code + PKCE login through the Lab and validate the ID token — no invite needed.

1. 1

   Open the Demo app and click “Sign in with IntegrAuth Lab”.

   The page is a public (PKCE, no-secret) relying party the Lab seeds for everyone — it sends you to /authorize with a PKCE challenge, a state and a nonce.

2. 2

   Approve the scopes, then watch the code come back and get exchanged.

   The browser POSTs the single-use code plus the PKCE verifier to /oidc/token with no client secret — a public client proves possession, not a shared secret.

3. 3

   See your ID token validated against the Lab’s JWKS, right in the page.

   The demo checks the signature, iss, aud, exp and your nonce against /.well-known/jwks.json, then calls /oidc/userinfo — exactly what a real RP must do before trusting a login.

4. 4

   “Trust, but verify”: fetch the standard discovery document.

   Nothing here was hardcoded — the endpoints came from /api/demo/config. A real RP has even less: it bootstraps trust from one public /.well-known/openid-configuration document, and this button proves the two independently agree.