token-endpoint-reviewer

Validate your OAuth2 Token Endpoint by auditing test cases against OIDC Core 1.0 Section 3.1.3 and OAuth 2.1 references. This process checks required parameters, token response fields, and code reuse protections to generate a conformance report identifying test coverage gaps.

Token Endpoint conformance testing should cover invalid_client and invalid_grant error scenarios. It also verifies proper handling of the authorization_code flow with client_secret_basic and client_secret_post authentication methods across various client configurations.

Token endpoint review focuses exclusively on the authorization_code grant type. It does not process other grant types, instead ensuring deep compliance with required parameters and client authentication methods for this specific flow.

Check for authorization code reuse by mapping test cases to specific spec sections enforcing code reuse protections. The review process verifies that your token endpoint correctly invalidates codes after initial use to prevent replay attacks.

Generate a conformance report by running a checklist-driven evaluation of token endpoint requirements. This review audits token response fields and maps each compliance criterion to referenced OAuth 2.1 and OIDC spec sections, outputting a concise gap analysis.