Mock SAML and OIDC IdP

Mock SAML and OIDC identity provider for testing SSO

Paste the SAML metadata URL, or the OIDC issuer with any client ID and secret, into your app. Sign in as anyone, at any email domain. No install, no sign-up, no client registration.

Your domain

Optional — per-tenant issuer for SAML and OIDC

Type any domain — the namespaced URLs below update instantly. Skip it to use the global URLs.

SAML 2.0 metadata URL

Paste this into your SP
Global view download
https://mockidp.dev/api/saml/metadata
Namespaced acme.io view download
https://mockidp.dev/api/namespace/acme.io/saml/metadata

OpenID Connect issuer

Point your app at this
Global discovery
https://mockidp.dev
Namespaced acme.io discovery
https://mockidp.dev/namespace/acme.io
Client settings No registration — any values work
Client ID
mock-client

Any string. It becomes the ID token’s aud.

Client secret
mock-secret

Any string, never checked. Leave it empty for a public client using PKCE.

Redirect URI
Your app’s own callback URL

Any absolute http or https URL is accepted.

Scopes
openid email profile
Token endpoint auth method
noneclient_secret_basicclient_secret_post

Authorization code flow. PKCE (S256) optional. ID tokens signed with RS256.

Example config 
OIDC_ISSUER=https://mockidp.dev
OIDC_CLIENT_ID=mock-client
OIDC_CLIENT_SECRET=mock-secret
OIDC_SCOPES="openid email profile"
  1. Copy the SAML metadata URL, or the OIDC issuer and client settings
  2. Paste it into your app’s SSO settings
  3. Start login from your app — any email and password work
Try SAML login Try OIDC login All endpoints FAQ
All endpoints

SAML, per-domain acme.io

SAML, global

OIDC, per-domain acme.io

OIDC, global

FAQ
What is a mock SAML identity provider?

A mock SAML identity provider stands in for a real IdP such as Okta, Entra ID, or Google Workspace while you build and test SSO. It issues genuinely signed SAML 2.0 assertions your service provider can validate, but it authenticates nobody: any password is accepted, so you can test login flows without provisioning users or waiting on IT.

Is it free, and do I need to sign up?

It is free and there is no sign-up. Point your app's SAML settings at the metadata URL, or its OIDC settings at the issuer URL, and start testing immediately.

Can I test multi-tenant SSO with different email domains?

Yes. Every URL has a namespaced twin, so a namespace per tenant gets its own issuer, its own metadata, and a login form with the domain prefilled. No domain allowlist means any email domain signs in.

Does it support SP-initiated and IdP-initiated login?

Both. Send an AuthnRequest over HTTP-POST or HTTP-Redirect for the SP-initiated flow and the audience and ACS URL are read from the request. Or open the login form directly and supply them yourself for an IdP-initiated test.

Are the SAML assertions really signed?

Yes. Assertions are signed with RSA-SHA256 using exclusive canonicalization, with the certificate embedded in KeyInfo, so your service provider validates the signature for real.

Does it support OpenID Connect?

Yes. It is also an OpenID Connect provider: authorization code flow, RS256 ID tokens signed with the same key, and PKCE S256. Point your app at the issuer URL. A namespace gets its own issuer, the same way it gets its own SAML entity ID. Any client ID and any http or https redirect URI are accepted, and the login form is the one SAML uses.

What client ID and client secret do I use for OIDC?

Any. There is no client registry, so pick any client ID, such as mock-client, and any client secret, or none at all for a public client using PKCE. Secrets are accepted via client_secret_basic or client_secret_post and never checked. Register any http or https redirect URI; the ID token's audience is the client ID you sent.

Can I use it in production?

No. It verifies no passwords and no domains, so it must never be used as a real identity source or pointed at production traffic. It is a testing tool. You can also self-host it from source.