Docs / Start from a token

Start from a token you already have

An optional shortcut when you want a test provider shaped like your current one. You can always start with the demo user and client instead.

Review before creating anything

1. Paste an ID token, an access token for your own API, or both. An expired token works; the page decodes it, it does not authenticate you with it.
2. Your browser removes the signature and replaces personal values with fictional ones. Review the inferred profile, client/API IDs, scopes, roles, lifetime and typed claims. Some names, IDs, scopes and roles are retained as shown and may still identify your project: edit or remove values you do not want sent.
3. Review the exact shape, accept the terms and choose Create scratchpad. Raw tokens, signatures, source issuer and source B2C identifiers stay in the browser; the reviewed shape is what is sent.
4. Run Test sign-in to inspect the issued tokens and compare their claims. Then follow the separate connect-your-own-app instructions.

Keep the configuration

The scratchpad can be edited only in the browser that created it. Choose Claim this scratchpad there and verify your email before expiry. Claiming keeps its IDs/configuration, ends scratchpad access and signs in the browser that confirms; you can return through email sign-in. Claiming a scratchpad uses its browser session and needs no claim code. Expired or discarded configurations cannot be restored.

Create a configuration in a tenant you own

Open the tenant using email sign-in. Choose Create configuration, give it a unique name, then choose From a token. Review the inferred shape before Create. You can also choose Demo user and client and its profile without a source token.

This adds a configuration within your plan’s limit and preserves existing configurations. If a name is already used, change it and retry without pasting again. Authenticated token creation remains available when anonymous scratchpads are disabled; sign up and verify your email for that path.

Supported input and limits

Browser token review needs JavaScript. Microsoft Graph tokens, Entra v1 tokens, encrypted tokens and opaque access tokens cannot be inferred. B2C sign-in tokens use a synthetic policy; custom journeys, password reset and multiple policies are not emulated. Check the reviewed profile rather than assuming it matches every provider feature.

See unverified tenant lifetimes, limits and the Entra guide. For development and testing only: use fictional people and development credentials.