Try with your token
Build a scratchpad to test your app. It lasts 24 hours unless you claim it.
Your token stays in this browser. The signature is removed, personal values are replaced, and you see exactly what is sent before anything is created.
An expired token works. Copy one from your browser's dev tools, your app's logs or your IdP's token tool.
Azure AD B2C tokens can use version 1.0 through v2.0 endpoints. Their source policy is replaced by synthetic policy B2C_1_signin. One configured-user sign-in policy is supported; custom journeys, password reset and multiple policies are not emulated. Entra ID v1 and Microsoft Graph tokens remain unsupported.
This is what we'll send
Claim names, scopes, audience, client and API IDs and roles are kept as pasted. Other personal values are replaced. Kept values are sent as shown; edit or remove anything private.