AuthTrace is a Chrome DevTools panel for IT and identity admins. It captures SAML, OpenID Connect, OAuth 2.0 and WS-Federation traffic, decodes it, checks signatures and tokens, and tells you what is wrong - audience mismatch, expired assertion, clock skew, wrong ACS URL - in plain words.
Open DevTools, sign in, read the diagnosis. No pasting tokens into third-party decoders, no switching tabs.
Redirect and POST bindings, SAMLRequest, SAMLResponse, RelayState and logout. Issuer, NameID, Audience, Destination, Recipient, InResponseTo and the validity window picked out for you.
Which element is signed, whether the signature verifies against the certificate in the message, SHA-1 and wrapping red flags, certificate subject, issuer, expiry and fingerprints.
authorize, callback, token, userinfo, logout, discovery and JWKS. id_token and access_token claims with human times; PKCE verifier checked against the challenge; state and nonce matched.
wsignin1.0 requests and RSTR responses with SAML 1.1 assertions, AppliesTo vs wtrealm and token lifetime checks.
Each problem says what it means and what to change. Entra ID (AADSTS), Okta, Keycloak and Auth0 error codes explained.
Import a HAR file or a SAML-tracer export, or paste a SAMLResponse, JWT or URL into the decoder.
AuthTrace asks Chrome for no permissions and no access to websites. It only sees traffic while DevTools is open on a tab, processes it on your computer, and never sends it anywhere. No accounts, no analytics, no telemetry. The one optional network request - "Verify with issuer keys" - downloads an identity provider's public signing keys when you click it. Privacy policy.
Pay on Stripe, get a licence key straight away, paste it into the panel. The key is checked offline. No subscription, no account.
What "AudienceRestriction not satisfied" means, how to find the two values that disagree, and where to change them in Entra ID, Okta and ADFS.
Base64, DEFLATE and the two bindings - how to read a SAML message by hand, and which fields matter when sign-in breaks.