Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog

## Introducing an OIDC Playground by Zitadel: The Fastest Way for Developers to Master Authentication

Let’s face it: authentication is rarely the part of your stack that gets developers excited. OIDC flows can feel like a black box, and when something breaks, you’re left deciphering cryptic errors, scouring docs, or waiting for support. That’s wasted engineering time and momentum.

  

At ZITADEL, we’re obsessed with building for developers and platform engineers. That’s why we created the [OIDC Playground](https://zitadel.com/playgrounds/oidc), a hands-on, interactive tool that lets you experiment with OpenID Connect authentication requests, see how ZITADEL responds, and iterate in real time. Whether you’re integrating, debugging, or just curious, this is your fast lane to understanding and control.

## What is Zitadel?

ZITADEL is an open-source identity and access management (IAM) platform built for modern, cloud-native applications. We help you ship authentication and authorization quickly, securely, and at scale without having to build or maintain complex identity infrastructure. ZITADEL delivers enterprise-grade security, true multi-tenancy, flexible deployment, and a developer-first experience.

## Why Zitadel?

Enterprises choose Zitadel as their IAM solution for several key reasons:

-   Eliminate expensive infrastructure development:  Go self-hosted or cloud, and skip months of building and maintaining IAM.
-   Built-in enterprise security features: From Passekys, to one-time passwords to Single Sign-on, we've got you covered.
-   Ready-made compliance controls:  Ready-made controls help you meet regulatory requirements.
-   Professional support and maintenance: You get professional help and upkeep.
-   More flexible and a transparent pricing model:  No surprises, no opaque “enterprise” gates.
-   Open-source transparency:  Inspect, contribute, or extend no black boxes.
-   Solid multi-tenancy support: It handles millions of tenants at scale.
-   Developer-friendly:  Integrate in days, not weeks, with modern APIs and docs.
-   Modern, API-first architecture: Provides a modern, API-first approach.
    

## What is OIDC?

[OpenID Connect](https://openid.net/developers/specs/) (OIDC) is the industry standard for authentication, sitting on top of OAuth 2. It lets your apps verify users’ identities and get profile information via secure, standardized tokens (JWTs). OIDC is enabled when a client includes the `openid` scope in an authorization request. The result? Your app receives an ID Token, a JWT containing “claims” about the user (like name, email, or custom attributes).

## What is the OIDC Playground from Zitadel?

An OIDC (OpenID Connect) playground is useful for developers, security engineers, and testers to experiment and debug OIDC flows in a controlled environment. The playground can be helpful in many different ways:

#### Learning and Experimentation

-   Understand how OIDC works by crafting an authentication request.
-   An OIDC authentication request is a standardized way for a relying party (an application or website) to request a user's identity information from an OpenID provider.
    

#### Debugging and Development

-   Easily modify parameters like client_id, scope, redirect_uri, response_type, etc., to observe how different parameters change the behavior
-   Useful for debugging issues like:
	-   Invalid redirect URIs
	-   Token decoding problems    
	-  	Scopes not returned as expected
    
## Pre-Requisites

-   A [self-hosted](https://zitadel.com/docs/self-hosting/deploy/overview) or [cloud](https://zitadel.com/signin) instance of Zitadel.
-   Create a new [Project](https://zitadel.com/docs/guides/manage/console/projects) and create a new [User.](https://zitadel.com/docs/guides/manage/user/reg-create-user)
-   Create a client.
-   Take a note of the issuer URL, which can be obtained by logging into your Zitadel instance.
-   Click Projects > Select the respective project > Select the respective application > Click URLs
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdhV734K4DL9ckcOlx-U25xXpWTrOS7WuT-FnTqI5P9Xj5x36fXF0iPrDd7vybYLHhenwXUzeMrOLQfMh2jieI4w1gFkIwvknsUm_EbyieUujmAr8WM_J1bluWrH6_P3FbUfwxLmg?key=bgcsq8E2ip6wVk3nVSJgBA)

-   Web App (Optional)- We are using the OIDC debugger in this tutorial    
-   To enable users to register with a local account (username/password), you need to enable the "register allowed" setting in the login behavior settings within ZITADEL.
-   When enabled, a registration button will appear on the login page, allowing users to create new accounts. You can specify the organization users are registered to during the registration process by including the organization scope in the authorization request.
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeV3Vr_efJwLQgLk1R1Atp83-AOH7NRtAGdNmvpSCMqmdsgw0R3Qn3ymhEmyl3NOAxEY0dLt90BQERdlcuz-Pj9vkFjc4qE-fYdlINSqBear_lnLiw5KA_gWiRdYYQBL64DVcEkGw?key=bgcsq8E2ip6wVk3nVSJgBA)

## How can you get started with the OIDC playground from Zitadel?

This playground will help you craft an authentication request initially and explore the behavior of ZITADEL in more depth.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXe_qtGjVMPdJGUX0r6U9PfpA-1mYWUcc5nmc70Z16RQMgul5IwvAUc4xmWIm5SsCNSuJBhnOOV14tCVWaX8mLMRiVADUBok81Te3suGh1HEtBf-6Sw0lpMH36-4pu5r9MUSBcmkHg?key=bgcsq8E2ip6wVk3nVSJgBA)

### Required Parameters

-   Your Domain- The Instance Domain for your ZITADEL instance.
-   Example: [https://amit-tme-zitadel-tuyhqf.us1.zitadel.cloud](https://amit-tme-zitadel-tuyhqf.us1.zitadel.cloud)
-   Client ID is the unique identifier assigned to a client application of an application. It's the application where you want your users to log in. You can find the client ID in the Console. Click> Project> Choose your respective project where the application has been created> Click on the Application > Click Configuration
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcsEc7lv5ssX6JrOp4t4o8K5PfI7CtNiT51j91LYJoKCWkRjB-0mxSag6xU_Saj3TbzHFck4ZSeb0s9jlUK0Assfa50azZ93uNgYQYg-SRzXkG7NlkLMjwtEDlm-TlmSUQe7k1R?key=bgcsq8E2ip6wVk3nVSJgBA)
-   Redirect URI is one of the pre-configured redirect URIs for your application.    
-   Example- [http://localhost:3000/callback](http://localhost:3000/callback)
-   Response Type defines whether a code, id_token token or just id_token will be returned. Most use cases will need code. This tells the authorization server which grant to execute. When you choose code, you will use the Authorization Code grant (recommended).
    

### Authentication methods

-   Depending on the authentication and authorization flow of your application, you might need to append some information to the authentication request.
-   Authentication method "(none) PKCE" is recommended for most application types. The playground automatically appends a code challenge for PKCE flows.

### Additional Parameters

Prompt defines if and how the user should be prompted on login. For example:

-   login: requires the user to re-authenticate.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdCZRyrhfKtDmnPxtbA32k4WdnhqQKFVVMXitM8c0Yi5MobPNQEf1wZ3BfNopM81sm1o2-j0cQLL8_RcG9eK6ZJckuI2M3vTwhAPA3xakzPGKql4l92nAJZuguMyyUhZXcfj60s0w?key=bgcsq8E2ip6wVk3nVSJgBA)

-   none: user must be authenticated without interaction, an error is returned otherwise; use for silent-refresh.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXfxa95i2sLLSEwG3jo9yZ87kVib2pzjrCUsvDR98JicKTYLs5iT0R1mkKNOmeWXKBglBjApUwjdljnuIAArcY_tIWOM5ViZ_FN_13qPRYb5QyDIOy3kB9gqG5q_kapmiNDsANYj?key=bgcsq8E2ip6wVk3nVSJgBA)

-   create: present the registration form.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXc45ZwhvspV3RQR6kBw6Xz0t4ZOjWYxxdNx0qNcVK706bTk2652ugrCkD7hbtfFAHp6_ow1bm6lGnfCEOzj0Tvake5oSyJH0jibDbwgDUIpgQlcUHG2J6oYbGQiGU5aR1km12U6?key=bgcsq8E2ip6wVk3nVSJgBA)

-   The user would be prompted to register.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeJA9qh-d1lOVVkYXKC0FNnq9IbiudTAJ2hG6iaSMBW-E4yKJ-5OSzYcNh_Ads232F0aT1S1JtMPQ2WVyh60KsIA1BVLS6GNE1oNZyqtBBfdAlHAD7ZuoCrU3XoU-dqt3kBrZM9Xw?key=bgcsq8E2ip6wVk3nVSJgBA)

-   select_account: The user is prompted to select one of the existing sessions or create a new one.
-   Using the login hint- The Login hint must be a valid logon name of a user. You can skip the account picker by providing the Login hint.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcQQQnfItiygoETRxHjpSQNnb4sYW8Yy7Xk1YxpS_9Szpwy_D_qAnDgGGF6pdPJXzYR-KXSxwSdnJhmafLd4frF5Pmz_am5Lj_V0Ov5ultILOPt0nzdM57-MAxXebnHv-rOhECe3g?key=bgcsq8E2ip6wVk3nVSJgBA)

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXf1FyQMwAlXAhSoxvLtZcwiep6xXjs3obrJmPJgvjYKeo0o0LYzzjNlcPYH9AnJ7Tyiz2Wv1UM4pBcjzYi8xToknEQ_ujDpEc6HU4r-KMrEswU9KwUTY51RT3mkKW10j48Iqnd5bQ?key=bgcsq8E2ip6wVk3nVSJgBA)

-   Without using the login hint- The user is prompted to select the respective user.
   
![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXct1CUvLP2aLtolMAftm2ExJWRdRTVI7UTFCusnX1PomxgmVXrNfWdbEDdznQWY7MXbDSd_hBBGTIZHk51Db_CYOQEw6Tdw-aDQiWpFPI4Kkn9YlJD-Uk2btsMn36rT1fJDcGp0Ag?key=bgcsq8E2ip6wVk3nVSJgBA)

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXc1C63ZZRAeTYMG78nYvA5ajzgNFPYGX_9o_CNsmqNc9RwlwEs5gBRpGl5-oq6UBy53NYjHTMO9DQ48guZXOpIzzozKPEvNPFNp48Jy4lffaSodsU7hLkeSvng_H2zXaezUikjr?key=bgcsq8E2ip6wVk3nVSJgBA)

## Conclusion

Hopefully, this tutorial gave you a good overview of how you can use the OIDC playground for testing OpenID Authentication Requests and can customize ZITADEL behavior with different parameters based on your organization's needs. We encourage you to [explore Zitadel](https://zitadel.com/signin) on the cloud or self-hosted environment(s). If you want to learn more before starting, request a demo today. Click the [button](https://meetings-eu1.hubspot.com/jason-burkhead/zitadel-discovery-call?uuid=8bf766b4-0058-4855-b97c-3613ed4cede8)to get in touch!

If you’re building in the Bay Area, or anywhere developers value speed, clarity, and control, the ZITADEL OIDC Playground is your shortcut to robust, modern authentication without the guesswork.

## How can I try out and contribute to Zitadel?

Read our [documentation](https://zitadel.com/docs) and learn how you can set up, customise, and integrate authentication and authorisation into your project. We would love to see you being a part of the Zitadel community, and you can reach us at

-   [Discord](https://discord.com/invite/zitadel)
    
-   [Github](https://github.com/zitadel/zitadel/)
    

## Suggested reading

-   [Zitadel Getting Started](https://zitadel.com/docs/guides/start/quickstart)
    
-   [OIDC and Zitadel](https://zitadel.com/blog/secure-logins-with-zitadel-part-1)
    
-   [Securing Applications with OIDC and Zitadel](https://zitadel.com/blog/secure-logins-with-zitadel-part-2)

At ZITADEL, we’re obsessed with building for developers and platform engineers. That’s why we created the OIDC Playground, a hands-on, interactive tool that lets you experiment with OpenID Connect authentication requests, see how ZITADEL responds, and iterate in real time. Whether you’re integrating, debugging, or just curious, this is your fast lane to understanding and control.

Introducing an OIDC Playground by Zitadel: The Fastest Way for Developers to Master Authentication

All posts/ #oidc

Introducing an OIDC Playground by Zitadel: The Fastest Way for Developers to Master Authentication

Why

Explore

Company