Test suite
IndieAuth Rocks!
Check that your IndieAuth server or client follows the specification — including the parts that keep people's accounts safe when something goes wrong.
Test your server
Enter your profile URL. This site acts as an IndieAuth client: it discovers your server, signs you in with it, then runs through authorization, token, refresh, revocation and security tests. Some steps ask you to approve or cancel a request.
Test your client
This site acts as an IndieAuth server with a set of test profile URLs. Sign in to your client with each one: some are set up normally, others misbehave on purpose to check that your client catches it.
Trouble signing in somewhere?
If an app won't let you sign in with your domain name and only says "login failed", this walks through the whole login with your own server and shows you every step — where it stopped, and what to do about it. No account needed.
Baseline behavior
Discovery, authorization requests, PKCE, code exchange, token responses and profile information.
Security checks
Unregistered redirect URIs, code replay, wrong verifiers, iss and state handling, and identity verification.
Implementation reports
Publish your results so others can see how well your software supports IndieAuth.
