OAuth Authorization URL Builder
Build an OAuth 2.0 authorization code URL for Google, GitHub, Microsoft or any provider, with scopes, state and PKCE, plus the curl to exchange the code for tokens.
Free · No sign-up · Your inputs stay in your browser
Input
Build an OAuth 2.0 authorization URL
Output
Authorization URL
GET
https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=1234567890-abc.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fcallback&scope=openid+email+profile&state=af0ifjsldkj
Token request
curl -X POST https://oauth2.googleapis.com/token \ -H 'Accept: application/json' \ -d grant_type=authorization_code \ -d code=CODE_FROM_CALLBACK \ --data-urlencode redirect_uri=http://localhost:3000/auth/callback \ -d client_id=1234567890-abc.apps.googleusercontent.com \ -d client_secret=YOUR_SECRET
Open the URL in a browser; after consent the provider redirects to redirect_uri with ?code=...&state=.... Check state matches what you sent, then exchange the code within a few minutes with the token request. The client secret belongs on a server only; a browser or mobile app uses PKCE instead.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The redirect URI must match exactly
Providers compare redirect_uri character for character with what was registered: a trailing slash, http versus https or a different port is a mismatch and the error is redirect_uri_mismatch. Register every environment's callback separately. The flow is defined in RFC 6749 section 4.1.
Refresh tokens
Google only returns a refresh token when access_type=offline is requested, and only on first consent unless prompt=consent forces the screen again. Other providers issue them for the offline_access scope or by configuration.