A spec-faithful mock Identity Provider: OAuth 2.x / OIDC, SAML 2.0, SCIM 2.0 — wire-faithful at the protocol boundary, with a tamper-evident audit log you can verify yourself.
The interactive playground signs you in through a real, certified flow and explains every message on the wire — no setup, two clicks.
Open the interactive playground
The same flows, from a real Android app (AppAuth, code+PKCE through the system browser): download the debug APK — CI-built, with the caveats on the download page.
Pick any tenant name ([a-z0-9-], max 63 chars) — it
provisions itself on first use with fixture users, SAML SPs, and OAuth
clients. The documented default is /dev.
curl -s https://<host>/dev/.well-known/openid-configuration
| Protocol | Surface |
|---|---|
| OIDC | /:tenant/.well-known/openid-configuration — discovery, code+PKCE, dynamic registration (RFC 7591) |
| SAML 2.0 | /:tenant/saml/metadata, /:tenant/saml/sso (Redirect + POST) |
| SCIM 2.0 | /:tenant/scim/v2/ — Users, Groups, filters, PATCH |
| Audit | /:tenant/audit/ — signed Merkle checkpoints, inclusion/consistency proofs |
kwiss — spec-faithful mock IdP. Everything here is synthetic and disposable: tenants auto-provision on first use, keys and credentials are runtime-minted throwaways. Tamper-evident, independently verifiable audit included. Not for production identities.