1. Overview

oauth2.dev is a developer tool site for OAuth 2.0 and OpenID Connect. Some tools run entirely in your browser. Others send requests to oauth2.dev so the server can fetch remote endpoints, validate protocol behavior, generate reports, or power hosted features such as Mock IdPs and dashboards.

We try to keep data handling narrow, useful, and proportionate to the job the tool is performing. We do not sell personal data.

2. Data You Provide

Depending on the feature you use, oauth2.dev may receive:

• endpoint URLs, issuer URLs, JWKS documents, OpenID metadata, or other protocol inputs submitted to validators and test tools
• OAuth parameters submitted to flow-testing tools, such as client identifiers, redirect URIs, scopes, codes, PKCE values, or token endpoint request fields
• redacted diagnostic reports you choose to save while signed in; these contain controlled result and finding identifiers used to render guidance, not raw tokens, authorization codes, client secrets, or PKCE verifiers
• account information and configuration data if you sign in and use dashboard or hosted Mock IdP features
• messages you send directly, such as support or feedback emails

3. Operational Telemetry and Logs

We collect lightweight operational telemetry to understand whether the tools are being used, whether validations are succeeding, and whether the service is healthy.

Diagnostic inputs are excluded from analytics and operational event payloads. In particular, submitted issuers, endpoints, tokens, authorization codes, credentials, PKCE values, request and response bodies, and raw error messages are not included in those payloads.

The controlled diagnostic event identifiers are:

• guide_viewed and guide_tool_selected
• diagnostic_started and diagnostic_completed
• next_check_selected

Those events contain only controlled identifiers such as the tool, guide, result classification, or next tool. Separate server-side operational events may include the controlled action and tool identifiers, input method, success or result classification, aggregate error and warning counts, and response timing.

Server-side operational events are delivered to a Discord webhook used for service awareness and lightweight internal metrics. The goal is operational visibility, not behavioral profiling.

Authorization testing may place short-lived OAuth flow context in same-tab session storage. That same-tab OAuth flow context is consumed and deleted when the callback is inspected. Callback response context is handled in the same consume-and-delete way.

4. How We Use Information

• to provide the tool or feature you requested
• to fetch and validate remote OAuth or OIDC endpoints
• to run hosted Mock IdP and dashboard features
• to monitor reliability, troubleshoot failures, and prevent abuse
• to improve the product and understand which tools are useful

5. Ads, Sponsorships, and Analytics

oauth2.dev may include privacy-respecting advertising or sponsorships. We do not use tool inputs such as submitted endpoint URLs, validation results, tokens, or keys for behavioral ad targeting.

Vercel Analytics and Cairngorm Labs receive page and controlled event data. Page URLs sent by checked-in analytics code exclude search parameters and fragments, and controlled diagnostic events contain only the identifiers described above. These processors may also process standard web request data under their own policies.

6. What You Should Avoid Submitting

Do not submit production secrets, confidential client secrets, sensitive user tokens, or private data to server-assisted tools unless you are comfortable with that processing. If a tool needs server-side validation or endpoint fetching, the submitted data may transit oauth2.dev infrastructure to complete the request.

For safer local experimentation, prefer test credentials and non-production environments.

7. Sharing and Service Providers

We may share data with service providers that help us operate the site, such as hosting, authentication, billing, email, and operational notification vendors. We may also disclose information when required by law or when reasonably necessary to protect the service, users, or others.

8. Your Choices

• You can choose not to use server-assisted tools for sensitive material.
• You can avoid creating an account if you only need public tools.
• You can block or limit cookies and similar browser storage using your browser settings, although some features may stop working.

9. Contact

Questions about privacy or data handling can be sent to privacy@oauth2.dev.

For a higher-level explanation of how the public tools work, see the homepage and the tool descriptions in the tools directory.