SAML / OAuth Inspector from Kevin Scattergood is a Chrome extension for inspecting Single Sign-On and identity federation flows. It captures browser authentication redirects and decodes otherwise opaque SAML and OAuth/OIDC payloads so engineers can read assertions and tokens without moving data to external decoders. The extension presents decoded assertions and token payloads in readable form, runs processing locally for privacy, and targets IAM engineers, security researchers, and web developers who debug federation.

What specific authentication messages does it capture?

The extension captures both SAML and OAuth traffic that flows through the browser. It recognizes SAMLRequest and SAMLResponse for HTTP-POST and URL/redirect styles and automatically detects OAuth 2.0 and OpenID Connect redirect parameters. Supported OAuth fields include code, state, id_token, access_token, and error, which makes it suitable for troubleshooting redirects and authorization errors without manual packet reconstruction.

How does it treat sensitive authentication data during inspection?

The tool is designed to process captured authentication data inside the browser so decoding does not leave the local environment. The developer built the extension to avoid sending authentication payloads to third-party servers, reducing exposure compared with copying tokens into online decoders. That local processing model is useful when working with proprietary claims or production identity providers during live troubleshooting.

How intrusive is the extension in day-to-day debugging?

The extension advertises a lightweight setup that requires only installation and pinning; it does not require elaborate configuration to begin capturing flows. Because it runs as a browser add-on on Chromium-based platforms, it integrates directly into interactive debugging sessions and avoids an extra decoding step. Its design aims to keep the browser workflow focused on the SSO exchange rather than adding separate tooling.

Which protocol details and provider scenarios does it support?

The tool decodes SAML assertions into fields such as Issuer, NameID, conditions, audiences, and attributes, and it exposes token payloads in a readable JSON-like view. It also includes a JWT payload viewer for id_token and access_token inspection. The developer notes real-world use with federation providers such as Entra ID, AD FS, and Okta, making the extension useful for common enterprise identity setups.

Practical in-browser inspection for hands-on identity work, not a cryptographic auditor

This extension is a practical option for IAM engineers and developers who need rapid, interactive visibility into browser SSO flows. It focuses on human-readable payload inspection and convenience; it does not perform cryptographic signature validation or act as a long-term audit collector. Use it as a browser-centric inspection tool alongside signature-checking or packet-level tools when formal verification or retention is required.