Overview
Trace and inspect OAuth 2.0, SAML, and OIDC authentication flows in the browser.
IAM Tracer is a developer and security engineer's companion for debugging authentication flows in the browser. It passively observes OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0 traffic as it happens and presents a structured, real-time timeline in the DevTools panel — no proxy to configure, no certificates to install, no traffic modification. WHAT IT CAPTURES • OAuth 2.0 — authorization code grants, implicit token flows, PKCE parameters, state values, and error responses • OIDC — token endpoint calls, discovery document fetches (.well-known/openid-configuration), and logout flows (end_session_endpoint) • SAML 2.0 — SAMLRequest and SAMLResponse POST bindings, decoded XML assertions, subject NameID, attributes, and status codes • JWT decoding — id_token and access_token claims decoded inline (header + payload) HOW IT WORKS IAM Tracer hooks into browser navigation events and network request completions using standard Chrome extension APIs. SAML POST bodies are extracted from form submissions in the page DOM. All parsing happens locally in your browser. NO DATA LEAVES YOUR BROWSER All captured events are stored in chrome.storage.session — they exist only for the current browser session and are automatically cleared when you close the browser. Nothing is sent to any remote server. WHO IT'S FOR • Frontend and backend developers integrating OAuth / OIDC / SAML • Identity engineers debugging SSO flows • Security engineers auditing authentication protocol implementations • QA engineers testing authentication edge cases v0.1.1 Fixed: extension now captures events from the inspected tab only, not all open tabs Fixed: JWT claims and SAML assertions now decode and display correctly in the detail panel Fixed: Gmail and other non-OAuth pages no longer trigger false OAuth error events v0.1.3 — DevTools Panel UI Overhaul Event list Protocol stripe: each event now has a 3px coloured left border (blue = OAuth, teal = OIDC, orange = SAML, red = error) so you can scan the list at a glance Method badge: GET / POST shown in colour next to the event type Status code badge: 200 in teal, 4xx/5xx in red URL shown in monospace on a second line
Details
- Version0.1.3
- UpdatedSeptember 6, 2026
- Offered byhtunn
- Size24.48KiB
- LanguagesEnglish (United States)
- Developer
Email
htunnthuthu.tech@gmail.com - Non-traderThis developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.
Privacy
This developer declares that your data is
- Not being sold to third parties, outside of the approved use cases
- Not being used or transferred for purposes that are unrelated to the item's core functionality
- Not being used or transferred to determine creditworthiness or for lending purposes
