Test suite
IndieAuth Rocks!
Check that your IndieAuth server or client follows the specification — including the parts that keep people's accounts safe when something goes wrong.
Test your server
Enter your profile URL. This site acts as an IndieAuth client: it discovers your server, signs you in with it, then runs through authorization, token, refresh, revocation and security tests. Some steps ask you to approve or cancel a request.
Test your client
This site acts as an IndieAuth server with a set of test profile URLs. Sign in to your client with each one: some are set up normally, others misbehave on purpose to check that your client catches it.
Baseline behavior
Discovery, authorization requests, PKCE, code exchange, token responses and profile information.
Security checks
Unregistered redirect URIs, code replay, wrong verifiers, iss and state handling, and identity verification.
Implementation reports
Publish your results so others can see how well your software supports IndieAuth.