devAuto-provisioned, ephemeral, synthetic. Everything below is ready to use.
Try the interactive playground — complete a real OIDC or SAML sign-in and read every message annotated.
| Discovery | https://id.knauth.in/dev/.well-known/openid-configuration |
| JWKS | https://id.knauth.in/dev/oauth/jwks |
| Public client | playground-spa (PKCE required) → redirect https://app.example.test/callback |
| Confidential client | playground-web (basic auth) → secret at https://id.knauth.in/dev/dev/client-secret?client_id=playground-web |
| Register your own | POST https://id.knauth.in/dev/oauth/register (RFC 7591, open registration) |
| PAR | POST https://id.knauth.in/dev/oauth/par (RFC 9126; single-use request_uri) |
| Machine tokens | grant_type=client_credentials (confidential clients) |
| DPoP | Send a proof JWT in the DPoP header (RFC 9449); tokens become sender-constrained (cnf.jkt) |
| Request objects | request= JWT, alg none or RS256 against your registered jwks (RFC 9101) |
| Agent delegation | grant_type=urn:ietf:params:oauth:grant-type:token-exchange (RFC 8693): act chains in introspection, attenuation only, every hop audited |
curl -s -X POST https://id.knauth.in/dev/oauth/register \
-H 'content-type: application/json' \
-d '{"redirect_uris":["https://your.app/callback"]}'
| IdP metadata | https://id.knauth.in/dev/saml/metadata |
| SSO endpoint | https://id.knauth.in/dev/saml/sso (Redirect + POST bindings) |
| Fixture SPs | https://sp.example.test/metadata (unsigned response, IdP-initiated allowed), https://signed-sp.example.test/metadata (signed response), https://signed-requests-sp.example.test/metadata (REQUIRES signed AuthnRequests; key at https://id.knauth.in/dev/dev/sp-key) |
| Name | |
|---|---|
jackson@example.test | Jackson Wright (default) |
samuel@example.test | Samuel Bishop |
Pick a user on any flow with ?email=…; SCIM-created users
join the pool at https://id.knauth.in/dev/scim/v2/Users (bearer token from
https://id.knauth.in/dev/dev/scim-token).
curl -s -X POST https://id.knauth.in/dev/audit/checkpoint # sign + anchor a Merkle checkpoint curl -s "https://id.knauth.in/dev/audit/proof/inclusion?seq=0" # prove a record is committed
kwiss — spec-faithful mock IdP. Everything here is synthetic and disposable: tenants auto-provision on first use, keys and credentials are runtime-minted throwaways. Tamper-evident, independently verifiable audit included. Not for production identities.