# OidcConfigAudit: check your OpenID Connect provider before a security review does

**OidcConfigAudit is a free, read-only check with 11 automated tests: Enter your issuer URL (for example https://login.yourcompany.com or https://yourtenant.example-idp.com/oauth2/default). We read the public /.well-known/openid-configuration and the signing keys it points to, and check them against the OIDC Discovery spec and current OAuth security guidance: exact issuer match, HTTPS everywhere, PKCE with S256, no implicit or password grants, no "none" or shared-secret-only signing, 2048-bit-plus keys, no private key material and a second key ready for rotation. Results are instant; copy-paste **

Enter your issuer URL (for example https://login.yourcompany.com or https://yourtenant.example-idp.com/oauth2/default). We read the public /.well-known/openid-configuration and the signing keys it points to, and check them against the OIDC Discovery spec and current OAuth security guidance: exact issuer match, HTTPS everywhere, PKCE with S256, no implicit or password grants, no "none" or shared-secret-only signing, 2048-bit-plus keys, no private key material and a second key ready for rotation.

## Unlock the complete deliverable

Your free check above is complete. The fix pack adds a copy-paste fix for every item that needs attention. The first 3 are below, free.

Tailor unlock for: My businessClient / agency auditSales / lead list

Add Pro monitoring instead: Weekly Monitor (5 domains), $9/month, re-checks on a schedule and emails changes

Unlock everything — $4.99 one-time →

Card, Apple Pay, Google Pay or Link via Stripe; refunds on request within 14 days.

✓ Read-only, live public data · Key and unlock right after payment · Card, Apple Pay, Google Pay or Link via Stripe · Refunds on request within 14 days

Preview what the unlock includes
- A copy-paste fix for every check that needs attention, written for your page
- Where each fix goes (page HTML, server headers or DNS) and how to confirm it
- Re-run the free check any time to verify

Already paid? Enter your key or email to unlock

Reads only the public discovery document and JWKS (2 requests); nothing is logged into or tested actively. Configuration evidence for your review, not a penetration test.

## Plans

Monthly
Yearly

### Copy-Paste Fix Pack

$4.99 one-time

- One-time $4.99: copy-paste fixes for every failing check on one domain
- Unlocked instantly with your key

Get Copy-Paste Fix Pack — $4.99 →

### Weekly Monitor (5 domains)

$9 / month ($0.30/day)

- Weekly read-only re-check of up to 5 domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log on your watch dashboard and API, plus email alerts on changes

Start Weekly Monitor (5 domains) →

### Agency 50-Domain Pro

$49 / month ($1.61/day)

- Daily checks for up to 50 client domains. Billed monthly (or yearly at the annual price); cancel any time
- Change log, CSV export and API access

Start Agency 50-Domain Pro →

## More ways to buy

### 500 API / MCP Credits

$9.99 one-time

- 500 full (unredacted) REST or MCP calls across every product
- Credits never expire

Buy now

### Unlimited API / MCP Key

$29 / month

- Unlimited full REST and MCP calls across every product. Billed monthly (or yearly at the annual price); cancel any time
- For Make, Zapier, n8n and AI agents

Subscribe

### Watch My Domain

$5 / month

- Weekly read-only re-check of one domain. Billed monthly (or yearly at the annual price); cancel any time
- Email when the result changes

Subscribe

### White-Label Client Report

$9.99 one-time

- One downloadable client-ready HTML report with your agency name and domain in the header
- No branding from us

Buy now

### Agency White-Label Pass

$79 / month

- Unlimited white-label client reports for this tool. Billed monthly (or yearly at the annual price); cancel any time

Subscribe

API: 10 free calls per day without a key. Datasets contain public records only, at organization level.

Payments are processed securely by Stripe. Refunds are available by default within the first 14 days of paid service.

## Copy-paste fix pack

## Often used together

- [B2BTrustCenterAudit](/trustcenteraudit)
- [SecurityTxtAndBugBountyKit](/securitytxtkit)
- [NyUniversityConstructionFundSignal](/v/nyuniversityconstructionfundsignal)
- [MoAsbestosDemoPulse](/v/moasbestosdemopulse)
- [Grants to Illinois Artists and Arts Organizations Pulse](/v/ilgrantsartistsartsorganpulse)
- [FranchiseOfferingDisclosureAudit](/franchiseofferingdisclosureaudit)