oidcscan

Synthetic issuer · not a real identity provider

A demo identity provider that keeps oidcscan honest

This is a small, real OIDC discovery endpoint and JWKS that oidcscan itself operates — built only to demonstrate the product. It is intentionally imperfect, and its published posture rotates through a fixed cycle once an hour, so anyone who scans or monitors it sees the grade change, and — if you're monitoring it — receives a genuine alert email each time it does. Nothing here is simulated after the fact: the metadata and keys served below are exactly what the scanner (and any client of yours) would fetch.

Issuer URL

https://oidcscan.integrauth.com/demo/idp

Scanning reads only the two public discovery paths and the JWKS — no account needed. Monitoring it is locked to a daily re-check for 3 days — enough to feel a real alert email fire — then expires on its own; a monitor on your own issuer isn't limited this way.

Right now

Down

Phase 7 of 10 · Outage

The issuer is unreachable — both discovery and JWKS fail (this phase serves 503).

Next change in ~4 min (2026-08-27 07:00 UTC)

The full rotation

One phase per hour, looping forever. Every alert type oidcscan can raise fires somewhere in this cycle — this is what to expect, and when.

  1. 01

    Baseline

    grade A

    A single signing key and a healthy certificate. One deliberate imperfection (only one signing key, so a rotation would have no overlap) keeps this shy of a spotless A+.

  2. 02

    Key rotation complete

    grade A+

    A second signing key (EC P-256) has been added — rotation overlap restored, closing the "single key" gap.

    key_addedfinding_resolvedgrade_change
  3. 03

    Certificate entering expiry window

    grade A

    The primary signing certificate now expires within 30 days (KEY-04 warn).

    cert_expiringgrade_change
  4. 04

    Certificate expired

    grade C

    The primary signing certificate has passed its expiry date — token signature verification may now fail (KEY-04 fail).

    cert_expiredgrade_change
  5. 05

    Certificate renewed

    grade A+

    The signing certificate has been renewed and is valid again.

    cert_renewedgrade_change
  6. 06

    Configuration regression

    grade F

    A deliberate misconfiguration: the "none" algorithm now appears alongside RS256, and PKCE has been downgraded to "plain" only.

    new_findinggrade_change
  7. 07

    Outage

    current unreachable

    The issuer is unreachable — both discovery and JWKS fail (this phase serves 503).

    endpoint_down
  8. 08

    Recovered, still degraded

    grade F

    The outage is over, but the misconfiguration from before it is still in place.

    endpoint_recovered
  9. 09

    Remediated

    grade A+

    The misconfiguration has been fixed — "none" and "plain"-only PKCE are both gone.

    finding_resolvedgrade_change
  10. 10

    Key retired

    grade A

    The second signing key has been retired ahead of the next rotation cycle, reintroducing the single-key gap.

    key_removednew_findinggrade_change

This is not a real identity provider

The issuer above exists only to demonstrate oidcscan. It advertises no real users, issues no real tokens, and its service_documentation field points right back to this page. Its posture is deliberately degraded and repaired on a fixed schedule purely so scanning or monitoring it produces genuine, reproducible results — including real alert emails, if you monitor it from a real account.

← Back to oidcscan