Sample app
Sign in with PKCE. Read the tokens.
What this shows The sample app starts an authorization-code flow with PKCE S256. The hosted page signs you up or in. This page then shows the ID token claims and /userinfo.
Try it: create an account, come back through sign-in, refresh the access token, then sign out. Demo users expire after 24 hours. No email is sent.
Signed in
ID token claims
Decoded locally. This page checks nonce, audience, issuer, and expiry. It does not verify the ES256 signature in the browser.