This page is a working app (a "relying party" / "service provider") that signs in against this tenant's IdP — the same certified endpoints production software would use. Click a button, complete a real flow, and read every message explained.
The modern default: your app redirects to the IdP, gets back a single-use code, and exchanges it server-side for signed tokens.
Sign in with OIDC (as Jackson) …as Samuel
The enterprise classic: XML documents signed by the IdP, delivered through your browser.
Sign in with SAML (SP-initiated) IdP-initiated …as Samuel
Beyond signing in: agent-era patterns, each run live and annotated.
Authorize an MCP client (RFC 8707/9728) Sender-constrained tokens (DPoP, RFC 9449) Device flow (RFC 8628) Delegation (RFC 8693) starts from the OIDC success page — it needs a live session to delegate.
| The IdP | this deployment, tenant dev — discovery at /dev/.well-known/openid-configuration, SAML metadata at /dev/saml/metadata |
| The app (RP/SP) | also this deployment, under /dev/playground/… — registered like any external client, no shortcuts |
| The users | synthetic fixtures (Jackson, Samuel) — you pick one on the IdP's mock sign-in page mid-flow; there are no passwords, choosing IS the credential |
Full endpoint reference for this tenant →
kwiss — spec-faithful mock IdP. Everything here is synthetic and disposable: tenants auto-provision on first use, keys and credentials are runtime-minted throwaways. Tamper-evident, independently verifiable audit included. Not for production identities.