Modern Identity API — free mock REST API for testing

A modern identity lab complementing the OAuth playground with OIDC discovery, PKCE, device authorization, introspection and revocation.

The Modern Identity API implements the parts of OpenID Connect that clients actually integrate against: a discovery document, PKCE, the device authorization flow and the full token lifecycle. If you are testing a login that runs on a TV, a CLI or anything without a browser redirect, the device-code flow here behaves like the real thing.

Base URL: https://funapi.dev/api/identity/v1 · 6 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.

Example request and response

GET https://funapi.dev/api/identity/v1/.well-known/openid-configuration — OIDC discovery document. No token, no signup:

curl -i https://funapi.dev/api/identity/v1/.well-known/openid-configuration

answers 200 OK with:

{
  "issuer": "https://funapi.dev/api/identity/v1",
  "authorization_endpoint": "https://funapi.dev/api/identity/v1/authorize",
  "token_endpoint": "https://funapi.dev/api/identity/v1/token",
  "jwks_uri": "https://funapi.dev/api/identity/v1/jwks",
  "code_challenge_methods_supported": [
    "S256"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access"
  ]
}

Open and run this endpoint

What you can practise here

Fetch the discovery document and drive the rest of the flow from its advertised endpoints rather than hardcoded URLs.
Complete an authorization-code exchange with PKCE, then retry with the wrong code_verifier and read the rejection.
Run the device-code flow and poll while it is pending until it is authorized.
Introspect a token, revoke it, and confirm the next introspection reports it inactive.

discovery

provider metadata

GET /identity/v1/.well-known/openid-configuration — OIDC discovery document · Responds with 200 Link to this endpoint
GET /identity/v1/jwks — Demo JSON Web Key Set · Responds with 200 Link to this endpoint

tokens

PKCE and lifecycle

POST /identity/v1/authorize — Issue an authorization code with real PKCE (S256) · Responds with 200 400 Link to this endpoint
POST /identity/v1/token — Exchange a PKCE code for scoped tokens — verifies BASE64url(/sitelet?url=https%3A%2F%2Ffunapi.dev%2Fdocs%2FSHA256%28codeVerifier)) against the stored codeChallenge · Responds with 200 400 Link to this endpoint
POST /identity/v1/introspect — Introspect an access token · Responds with 200 Link to this endpoint
POST /identity/v1/revoke — Revoke an access token · Responds with 204 Link to this endpoint

Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry.
Webhooks API — Register callbacks, trigger events, inspect & replay deliveries.
Protocol Lab API — Async jobs, redirects, 503/504, JSON Patch & content negotiation.
Object Storage API — Objects, checksums, ranges & resumable uploads.

All 39 mock REST APIs

Use this response elsewhere

JSON to TypeScript on fundata.dev — an interface for this response
JSON to Zod on fundata.dev — a runtime validator for it
mock API data on fundata.dev — thousands of records of the same shape for your own fixtures

Last updated 2 October 2026