# OidcConfigAudit alternatives

> There are three ways to get openID Connect discovery and JWKS audit: issuer match, HTTPS endpoints, PKCE S256, deprecated implicit and password grants, signing algorithms, key size and rotation: do it by hand with a browser and developer tools (free, manual), use OidcConfigAudit (free scan with the full result, paid plans from $4.99), or buy a broader website audit and SEO tools platform (wider coverage, priced per vendor). OidcConfigAudit fits saaS platform and identity engineers running their own OIDC provider, security reviewers and pentest-prep teams, and B2B SaaS vendors answering enterprise SSO questionnaires who want the answer in minutes without a sales call.

| What you need | OidcConfigAudit | Do it yourself | Broader website audit and SEO tools platforms |
|---|---|---|---|
| Cost | Free scan with the full result; fix pack and monitoring from $4.99 | Free | Varies by vendor; check their sites |
| What it checks | 11 checks: Discovery document has every required field, issuer exactly matches the discovery URL, Every endpoint uses HTTPS, PKCE with S256 advertised, No implicit-flow response types, No resource-owner password grant, … | Whatever you know to look for | Usually a broad suite of checks |
| Time | Under a minute per site | Often an hour or more per site | Setup and onboarding first |
| Fixes | Plain-English explanation per check; copy-paste fix pack | You write them | Varies by vendor |
| Monitoring | Optional scheduled re-checks with email on change | Repeat by hand | Usually included |
| Changes to your site | None: read-only, nothing to install | None | Some require a tag, plugin or agent |
| Best when | You are saaS platform and identity engineers running their own OIDC provider, security reviewers and pentest-prep teams, and B2B SaaS vendors answering enterprise SSO questionnaires and want a quick, specific answer | A one-off check by someone technical | You need an enterprise-wide platform |

- [PrivacyHeaderPulse](https://zalwin.com/privacyheaderpulse): Security and privacy header check with fixes
- [SecurityTxtAndBugBountyKit](https://zalwin.com/securitytxtkit): RFC 9116 security.txt, CAA record and disclosure-policy generator
- [CookieConsentPulse](https://zalwin.com/cookieconsentpulse): Live website pre-consent tracking pixel, third-party script and CMP banner compliance scanner
- [GdprDpaRopaKit](https://zalwin.com/gdprdparopakit): Third-party script inventory, consent banner, privacy/DPA/subprocessor pages and an Article 30 technical worksheet (not legal advice)
- [SubprocessorRadar](https://zalwin.com/subprocessorradar): Cloud, AI, auth, billing, analytics and support vendors a SaaS company publicly discloses or loads
- [B2BTrustCenterAudit](https://zalwin.com/trustcenteraudit): Security, privacy, DPA, subprocessor and status page readiness teardown for enterprise security reviews
- [B2BStatusPageSlaAudit](https://zalwin.com/b2bstatuspageslaaudit): Status page, summary.json, incident feeds, subscribe options, SLA and security links
- [StatusSLACreditKit](https://zalwin.com/statusslacreditkit): Major vendor incidents vs your SLA with a drafted credit-claim email you send

**Is OidcConfigAudit free?** Yes: the scan and its full result are free without an account. The copy-paste fix pack and scheduled monitoring are paid, from $4.99.

**What is the free alternative to OidcConfigAudit?** Check the same items by hand with your browser's developer tools and the page source. OidcConfigAudit runs the checks automatically and explains each result.

**When is a broader website audit and SEO tools platform a better fit?** When you need many data types or checks in one contract and have budget for it. OidcConfigAudit does one job; compare features and prices on each vendor's own site.

Source: https://zalwin.com/compare/oidcconfigaudit-alternatives