OAuth Permission Explorer

What an OAuth consent request really allows: scopes, risky combinations and flow problems.

Try an example: Google consent URL with Gmail + offline access · GitHub token scopes · Microsoft Graph implicit flow

How it works

Paste OAuth scopes or a full authorization URL for Google, GitHub, Microsoft Graph, Slack or generic OpenID Connect. Every scope is explained from the provider's official documentation with a sensitivity rating; risky combinations (read + send mail, offline access to files, push code + delete repositories, CI workflow edits) and unsafe request settings (implicit flow, missing PKCE or state, plain-HTTP redirect) are flagged. Unknown scopes are listed, never guessed.

Input is split on spaces/commas; a full URL is parsed for scope, user_scope (Slack), client_id, redirect_uri, response_type, prompt, access_type, code_challenge(_method), state and nonce.
Provider = your choice, else the authorization host (accounts.google.com, github.com, login.microsoftonline.com, slack.com), else the provider most scopes uniquely belong to. Microsoft Graph scopes match with or without the https://graph.microsoft.com/ prefix, case-insensitively.
Scope descriptions come from a curated dataset copied from each provider's official scope reference (URL per scope). Only scopes found on those pages are included; anything else is reported as unknown.
Sensitivity (low/medium/high/critical) is an editorial rating of what a leaked token could do; Google's own Non-sensitive/Sensitive/Restricted class and Microsoft's admin-consent flag are shown where documented.
Risky combinations are rules over capabilities (e.g. mail.read + mail.send, repo.write + repo.delete, offline + files.read). Flow checks follow RFC 9700 (OAuth 2.0 Security BCP) and RFC 7636 (PKCE).

For scripts and AI agents

JSON API: POST https://oauthpermissionexplorer.usefulweb.site/api/v1/calculate (same calculation as this page)
Interface description: OpenAPI 3.1 · AI guide: llms.txt
MCP server (Streamable HTTP): https://oauthpermissionexplorer.usefulweb.site/mcp · tool name oauth_permission_explorer

Example request

curl -s -X POST https://oauthpermissionexplorer.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{"request":"https://accounts.google.com/o/oauth2/v2/auth?client_id=123.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fapp.example%2Fcb&response_type=code&access_type=offline&prompt=consent&scope=openid%20email%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fgmail.readonly%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fgmail.send&state=xyz","provider":"auto"}'

Related tools

Security Configuration Scanner – Passive, graded check of a domain's TLS, security headers, DNS security and security.txt.
Dependency Vulnerability Explorer – Known vulnerabilities in your dependencies, and the version that fixes each one.