Mock OAuth2 Flow Data Generator

How to use

1. 1️⃣
   Choose your options above
2. 2️⃣
   Click Generate
3. 3️⃣
   Copy your result

Detailed instructions

1. Select your target grant type from the OAuth2 Flow dropdown: authorization code, client credentials, refresh token, or implicit.
2. Set the Number of Samples to how many distinct payloads you need — use 3 to 5 for documentation, more for seeding large test fixtures.
3. Click Generate to produce complete, structured request and response payloads for the chosen flow.
4. Copy individual samples directly into your test file, Postman collection, or mock server stub as needed.

Use Cases

• •Seeding Postman collections with realistic OAuth2 token response fixtures for all four grant types
• •Unit testing JWT parsing logic in Node.js or Python against plausible access token strings
• •Populating WireMock or Mockoon stubs with RFC-6749-compliant token response payloads
• •Writing API reference docs with concrete token exchange examples instead of placeholder text
• •Testing refresh token handler logic with correctly structured request and response bodies

Tips

• →Generate authorization code samples alongside client credentials samples to test that your code handles both user-delegated and machine tokens correctly.
• →Set count to 10 or more when seeding database fixtures — having varied token strings prevents false positives caused by duplicate-detection logic in your tests.
• →Use the refresh token flow samples specifically to test your token expiry and retry middleware: plug the mock expired access token into a request and verify the refresh path fires.
• →Compare the implicit flow output with the authorization code output side by side when teaching — the absence of a refresh token in implicit is immediately obvious and sparks useful discussion.
• →When using generated payloads with WireMock, set expires_in to a high value like 3600 so your client's expiry checks do not trigger unexpectedly during a test run.
• →Regenerate samples for each test run rather than committing a single static fixture — this catches bugs where your parser hardcodes expected token values instead of parsing them dynamically.

FAQ