Open OAuth tools
For developers building with OAuth

Exchange credentials.
Get a verified token.

Get a verified token in one guided workflow. Choose a provider, enter the fields required by its OAuth flow, and complete authorization, token exchange, and verification, all in one place.

Find your providerWhy this exists

Example workflow

Pick a provider and run a simulated handshake

3 steps
Provider

CommerceBuilt-in workflow

  1. 1Enter app detailsShop domainClient IDClient secretGrant typeStep 1
  2. 2Exchange credentialsPOST {shop}.myshopify.com/admin/oauth/access_tokenStep 2
  3. 3Verify the tokenGET {shop}.myshopify.com/admin/api/{version}/shop.jsonStep 3
OutcomeVerified Admin API access token
Open Shopify workflow →

Simulated preview. Nothing is sent and no credentials are needed.

Built out of frustration.

OAuth Hub makes the OAuth handshake simple, repeatable, and painless.

Different providers call the same thing different names. Redirect URLs have to match character-for-character. Authorization codes expire. Some APIs return errors with a 200 OK. Refresh tokens rotate. PKCE shows up when you least expect it.

  • client_id ≠ app_key ≠ RuName

    Same thing. Different names.

    Providers love their own terminology. We use it too, so you always know exactly what goes where and what gets sent.

  • redirect_uri_mismatch

    One character can break the whole flow.

    See the registered redirect value while you configure each provider, then catch the callback without digging through logs.

  • invalid_grant

    Codes shouldn’t expire while you’re copying them.

    The callback captures the authorization code and state for you, then clears them from the URL automatically.

  • 200 OK {"ok": false}

    A 200 OK doesn’t always mean success.

    We inspect the response body for provider-specific errors instead of trusting the HTTP status alone.

  • refresh_token rotated

    Refresh tokens don’t follow one set of rules.

    Get the provider’s refresh requirements up front, check token age, and see exactly when a token is due to expire.

  • code_verifier required

    PKCE: required sometimes, essential when it is.

    OAuth Hub knows which providers require PKCE and surfaces the fields you actually need, nothing more, nothing less.

Three steps.
One verified token.

  1. 01

    Prepare

    Pick a provider and enter your app’s details.

  2. 02

    Exchange

    Authorize and swap the code for tokens.

  3. 03

    Verify

    Test the token against the provider.

Who it's for

For the people who
wire things together.

OAuth Hub is for anyone who needs to get through an OAuth flow, get a real token, and keep moving.

  • Web agencies

    Get a client authorized and verified while you’re on the call, not three email threads later.

  • Freelance developers

    Need a token for a one-off integration? Run the flow, get the token, and move on. No throwaway OAuth code required.

  • Software engineers

    Inspect the token you actually received: verify it, check its scopes, and see exactly what the provider returns.

Use the form.
Or call the endpoint.
Or build your own flow.

The page runs on the same server routes you can call from your own tooling. Provider not listed? Describe any OAuth 2.0 provider, run the flow, and export it as code.

Build a custom flowOpen the provider catalog
token-exchange.js
const res = await fetch('/api/shopify/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    shopDomain: 'your-store.myshopify.com',
    clientId,
    clientSecret,
  }),
});

const { token } = await res.json();
// verify the token in the next request

The token is the
easy part now.

Find your provider