Federation messages
HTTP-POST and Redirect bindings, assertions, conditions, signatures, attributes and embedded certificates.
Chrome DevTools extension
Enterprise Authentication Flow Inspector
Troubleshoot the browser-visible authentication story, from the first protected-resource request through redirects, credentials, tokens, cookies, callbacks, and the final application return.
- Local analysis
- No remote code
- Open source
SAMLOAuth / OIDCOAM / WebGateKerberos / WNA
NTLMX.509OktaMicrosoft Entra ID
Selected-request evidence and complete-flow context
See what happened. Keep the evidence attached.
Move from raw browser traffic to a correlated assessment without losing the exact request, response, cookie, token, certificate, or correlation identifier behind each conclusion.
Protocol-aware, vendor-aware
One investigation surface for mixed enterprise identity stacks.
Authentication failures rarely stay inside one product boundary. The inspector keeps evidence from redirects, cookies, headers and payloads in a single sequence.
OAuth and OpenID Connect
Authorization, callbacks, JWT claims, state, nonce, PKCE, issuer, audience and token lifetime signals.
OAM and WebGate
Protected resources, server endpoints, authentication cookies, request IDs, ECIDs and application returns.
Kerberos and NTLM
Negotiate challenges, browser responses, protocol selection, NTLM fallback and repeated authorization failures.
Client certificates
Credential-collection endpoints, forwarded certificate headers and browser-visible certificate metadata.
Okta and Entra ID
Provider recognition, tenant or organization context, provider errors and log correlation identifiers.
A repeatable investigation path
From capture to an engineer-ready assessment.
Work live in DevTools or import a HAR from another environment. Export a sanitized report for collaboration or retain full correlation values for controlled diagnostic work.
Read the documentation- 01
Capture or import
Record the active inspected tab, load the Network HAR, or import a saved HAR/JSON trace.
- 02
Reduce the noise
Filter by protocol, hide static resources and search across browser-visible requests and responses.
- 03
Correlate the flow
Use Flow Analysis to group related exchanges, validation checks, evidence and recommended next actions.
- 04
Share the assessment
Export sanitized or full-diagnostic Markdown with timelines, correlation keys and server-log guidance.
Privacy by design
Authentication data stays in your browser.
Analysis runs locally inside the extension. Captured traffic, cookies, tokens, SAML messages, authentication headers and imported HAR data are not sent to the developer or third parties.
The inspector analyzes browser-visible evidence. Server-to-server exchanges, KDC traffic, backend logs and cryptographic trust validation remain outside that scope.
Read the privacy policyOpen source Chrome DevTools extension