OAuth 2.x · OIDC · SAML 2.0 · SCIM 2.0 · MCP auth
A mock Identity Provider you can't tell from production.
kwiss is a spec-faithful, multi-tenant mock IdP — wire-faithful enough that real integrators can't distinguish it from a production system at the protocol boundary, with a tamper-evident audit log you can verify yourself.
Certified-green Both OpenID certification test plans (Config OP, Basic OP) run with zero failures and zero warnings on every push.
One request to a running IdP
No signup, no setup, nothing to clean up. Pick any tenant name and it provisions itself on first use with fixture users, SAML SPs, and OAuth clients.
curl -s https://play.kwiss.dev/dev/.well-known/openid-configurationWhat's in the box
OAuth 2.x & OIDC
code+PKCE, DCR, PAR, DPoP, request objects, device flow, token exchange, the full logout family, JWT access tokens.
Coverage →SAML 2.0
SP- and IdP-initiated SSO over both bindings, signed and encrypted assertions, inbound request signatures, Single Logout.
Coverage →SCIM 2.0
Users and Groups with the complete filter grammar and an atomic PATCH engine — RFC 7643/7644, error paths included.
Coverage →MCP authorization
A reference AS for MCP auth, mock resource servers, a standalone conformance harness, and a hosted grader for your own server.
Coverage →Verifiable audit
An append-only hash chain with signed Merkle checkpoints — inclusion and consistency proofs you can check independently.
How it works →Agent delegation
RFC 8693 token exchange as delegation, not impersonation: attenuation only, nested actor chains, every hop audited.
Coverage →Built oracle-first
"Done" is defined by independent graders, not by our own tests: the OpenID conformance suite for OIDC, a different implementation cross-verifying every SAML signature, RFC 7643/7644 tests for SCIM — error paths and all. If a security check would have to be weakened to pass, we stop.