Auth Platform · Live Demo
— / 5 left today JWKS ↗

Try the authentication service, live.

This page talks to a real Spring Boot identity provider — the same one whose source is on GitHub. Nothing here is faked: every step below is a genuine HTTP call to the service, and the request & response are shown to you in full. Passwords hash with BCrypt, tokens are RS256 JWTs verified against a standard JWKS endpoint, and passkeys use real WebAuthn (Touch ID / Windows Hello / a security key).

i Actions are limited to 5 per day per network. Use a throwaway email & password — this is a public demo.
  1. 1

    Create an account

    Password is BCrypt-hashed server-side (capped at BCrypt's real 72-byte limit). POST /auth/register

  2. 2

    Log in with the password

    Returns an access + refresh token pair. We decode the access token below so you can see the verified claims. POST /auth/login

  3. 3

    Add a passkey

    Uses your access token to bind a WebAuthn credential to the account. Your device will prompt for Touch ID / Windows Hello / a security key. POST /passkey/register/init → /complete

    Log in first (step 2) to enable this.
  4. 4

    Log in with the passkey

    No password. The server issues a single-use challenge, your authenticator signs it, and the signature is verified with anti-replay sign-count checks. POST /passkey/login/init → /complete

    Register a passkey first (step 3).
  5. 5

    Call a protected endpoint

    Sends the bearer token to a route guarded by the JWT library. The token is verified by signature (RS256, by kid, against the live JWKS), issuer and expiry before the handler ever runs. GET /passkey

    Log in (step 2 or 4) to get a token first.