TokenTriage

TokenTriage is a web app + lightweight CLI that spins up realistic auth and identity mocks for API testing: OAuth2/OIDC flows, rotating JWTs, refresh tokens, key rotation (JWKS), scopes, tenant isolation, and common failure modes (expired tokens, clock skew, revoked sessions). Instead of a generic mock server, it focuses on the part teams repeatedly get wrong: authentication edge cases that only show up under load or after weeks in production. You define your auth contract once (issuer, audiences, claims rules, scope policies), then generate deterministic test tokens and a programmable “identity provider simulator” that can be used in local dev, CI, and ephemeral preview environments. It also records and replays auth-related request/response traces to reproduce flaky 401/403 issues. This is not magic: it won’t replace a real IdP, but it will make auth testing far less fragile and far more comprehensive.