AuthTailor 1.0.0 is out (8 November 2026): the SAML & OIDC tracer as an extension of its own – free, no account, no server. What’s inside → +43 664 1964199Contact →

Sunday, 8 November 2026

AuthTailor

“Login broken?
Record it.”

Free · no accountVersion 1.0.0of 8 November 2026 →
InstallContact DE
Install
SAML & OIDC tracer in your browser

Single sign‑on, made visible.

A login fails, and the identity provider only says “invalid_grant” or an error number. AuthTailor is a browser extension that records the login live, takes tokens apart, checks signatures and shows at which step it breaks – locally in your browser, with no server.

The small numbers are sources: tap one to see the source and the date it was checked; all of them are listed at the bottom of the page.

Install for free → Watch the video All features
  • Free, no account
  • No server, no telemetry
  • Host access only while recording
  • No cookies on this site
AuthTailor panel: live recording of a login as a sequence diagram of browser, app and identity provider, with the checked parameters
Fig. 1 — Live recording of a login with OpenID Connect and PKCE: every step as a diagram, every parameter checked. All pictures show made-up data.
Video · no sound

One login, recorded and explained.

Record, sign in, take the token apart, read the finding – once from start to finish on a made-up app. The video is hosted on this website and only loads when you start it.

Watch on YouTube ↗ The link opens YouTube; Google’s privacy terms apply there.

Five tabs

Everything a login gives away – in one panel.

AuthTailor opens as a side panel next to the tab where you sign in. Five tabs cover what you would otherwise gather from five tools while troubleshooting.

A JWT taken apart into header, payload and signature, with chain of trust and ID card
Auth Trace

See the token, don’t just read it.

Record or paste: a SAML Response, a JWT, a login URL, a HAR file or simply the error message. The JWT appears taken apart into header, payload and signature, with the chain from issuer to audience and an ID card with scopes and roles.

Signatures are really checked – SAML with the certificate, JWTs with the issuer’s keys.

A SAML Response as nested building blocks with seal and colour-coded findings
Auth Trace · SAML

SAML as it sits in the XML.

Response, Assertion, Subject and Conditions nested as in the XML, with a seal on every signature and a colour per finding. Plus the attack patterns you overlook in raw text: signature wrapping, duplicate IDs, a comment in the NameID.

Tools: a Content Security Policy rated, with a stricter suggestion
Tools

What goes wrong around the login.

Passkey responses, certificates and keys, Content Security Policy, security headers, CORS and suspicious login links. A HAR cleaner masks cookies, tokens and passwords before a recording goes to support.

SAP tab: Why 403 – the token’s scopes against the expected scopes
SAP

“Why 403?” – scope by scope.

For everyone on SAP BTP: XSUAA and IAS tokens, reviews of xs-security.json, xs-app.json, service keys and destinations, logon tickets and the BTP flows as diagrams. “Why 403?” puts what the app requires next to the token.

Learning tab: a flow as a sequence diagram to click through
Learning

Understand what you are looking at.

13 flows of OAuth 2.0, OpenID Connect and SAML as sequence diagrams to click through, basics in eight chapters, a glossary, known error messages and a go-live checklist. When the tracer detects a flow, one click leads to its explanation.

All features in detail →

MASKED.

Sharing a recording usually means sharing cookies, codes and tokens. AuthTailor masks them as they are recorded, and the report for the ticket contains masked values only. The yellow markers on this page? Each one has a source with the date it was checked.

All sources
The traffic light

Not just whether it works. Whether it is safe.

A login can work and still have a hole. The traffic light rates five areas separately – purely functional findings such as a wrong audience do not count there.

  1. Flow& protocol

    state, nonce, PKCE, redirect_uri, InResponseTo and RelayState across the whole flow.

  2. Tokens& signatures

    Signature, issuer, audience, expiry, key rollover, jku and x5u in the header.

  3. Transport& leaks

    Codes in the Referer, tokens in the URL, client secrets sent from the browser.

  4. Cookies& session

    SameSite, HttpOnly, Secure, __Host-, session fixation and logout.

  5. Browserprotection

    HSTS, frame protection, Referrer-Policy and scripts without SRI.

Privacy

No server. No account. Nothing stored.

A tool that sees tokens and logins has to explain itself. That is why AuthTailor is built so that there is little to explain.

Security in detail →
  1. The analysis runs in the panel. No telemetry, no analytics, no third-party code – the extension sends none of your data.
  2. Nothing on disk. Recordings and input stay in memory only, while the panel is open.
  3. Only for recording. Access to websites is requested only when you record and handed back afterwards.
  4. Public keys, on click. Only when you want signatures checked does the panel fetch the issuer’s public keys – without cookies, without your input.
Install · version 1.0.0

Two minutes to your first finding.

Free, no account. The extension is available for Chrome, with builds for Edge and Firefox.

Review in progress Version 1.0.0 is built and publication in the Chrome Web Store is under way. Until then you can get the extension on request as a package to load – with all features.

  1. Installand open the panel from the extension’s icon.
  2. RecordPress “Record live”; the browser asks once for access.
  3. Sign inin the tab of the app that causes trouble – or paste a message, token or HAR.
  4. Read the findingsDiagram, traffic light, cause and fix; the report goes into the ticket masked.
To be honest

When AuthTailor will not help you.

A checking tool that only knows advantages has not checked itself. Here is our list.

  • The error is between two servers.Client credentials, SAML bearer or principal propagation do not pass through the browser – nothing can record them there. You can still paste the messages, and Learning explains the flow.
  • You want the configuration fixed for you.AuthTailor shows the cause and the fix. You change it in the identity provider or the app – on purpose: the extension writes nowhere.
  • You are looking for a penetration testing tool.AuthTailor observes and rates; it attacks nothing and changes no request. Active testing has its own tools.
  • Your browser may not run extensions.Then IT comes first. For them, the Security page lists which permissions AuthTailor needs and when.
From the authors at SAP PRESS

From practice with SAP BTP and identity providers.

AuthTailor comes from CloudDNA. Its founder Martin Koch wrote the books on security, connectivity and administration of SAP BTP with Siegfried Zeilinger – much of what the tracer checks is explained there in depth.

Covers: Rheinwerk Verlag (SAP PRESS). The links go to the publisher.

For SAP Integration Suite

The tracer also lives in iFlowTailor.

AuthTailor grew out of iFlowTailor, the workbench for SAP Cloud Integration. If you build iFlows, you get the same tracer there, next to review, testing and error analysis.

See iFlowTailor ↗ Advice on SSO on SAP BTP
The Tailor family

Thirteen siblings – each for its own craft.

Every Tailor solves a problem we know up close. Most siblings share the Tailor-Plattform with EU data residency and an AI layer. AuthTailor is the smallest of them: no server, no data storage, just a panel next to your tab. It started out as the SAML & OIDC tracer in iFlowTailor – and it still lives there too.

Sources on this page

The superscript numbers in the text point here. Tap one to see the source right where it is used; all sources of this website are listed on one page.

  1. 1

    Browser extension for Chrome, with builds for Edge and Firefox ↑Product · AuthTailor product documentation, README and build configuration · checked on 2026-11-08

  2. 2

    Record live in any tab ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08

  3. 3

    No server, no telemetry ↑Product · AuthTailor product documentation, privacy policy of the extension, “In short” · checked on 2026-11-08

  4. 4

    Free, no account and no licence ↑Product · AuthTailor product documentation, README · checked on 2026-11-08

  5. 5

    Screenshots and video with made-up data ↑Product · AuthTailor product documentation, Chrome Web Store materials · checked on 2026-11-08

  6. 6

    Five tabs ↑Product · AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08

  7. 7

    Paste or drop ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08

  8. 8

    Visual anatomy of JWT and SAML ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08

  9. 9

    Signatures really checked ↑Product · AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08

  10. 10

    Attack patterns and leaks ↑Product · AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08

  11. 11

    Tools: passkeys, certificates, web security ↑Product · AuthTailor product documentation, README and changelog 1.0.0, Tools · checked on 2026-11-08

  12. 12

    Clean a HAR file ↑Product · AuthTailor product documentation, changelog 1.0.0, Tools · checked on 2026-11-08

  13. 13

    SAP BTP: tokens, configuration, flows ↑Product · AuthTailor product documentation, README and changelog 1.0.0, SAP · checked on 2026-11-08

  14. 14

    “Why 403?” ↑Product · AuthTailor product documentation, changelog 1.0.0, SAP · checked on 2026-11-08

  15. 15

    13 flows, eight chapters, glossary, error catalogue, checklist ↑Product · AuthTailor product documentation, README and changelog 1.0.0, Learning · checked on 2026-11-08

  16. 16

    Masked as it is recorded ↑Product · AuthTailor product documentation, privacy policy of the extension, masking · checked on 2026-11-08

  17. 17

    Traffic light in five areas ↑Product · AuthTailor product documentation, changelog 1.0.0, security check · checked on 2026-11-08

  18. 18

    Headers per step, masked ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08

  19. 19

    In memory only, while the panel is open ↑Product · AuthTailor product documentation, privacy policy of the extension · checked on 2026-11-08

  20. 20

    Permissions and host access ↑Product · AuthTailor product documentation, README, “Privacy and permissions”; Chrome Web Store materials · checked on 2026-11-08

  21. 21

    The one request: public keys on click ↑Product · AuthTailor product documentation, privacy policy of the extension · checked on 2026-11-08

  22. 22

    Markdown report, masked ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08

  23. 23

    CloudDNA GmbH – SAP Silver Partner ↑Vendor · clouddna.at, start page and team · checked on 2026-11-05

  24. 24

    Books on security, connectivity and administration of SAP BTP ↑Vendor · Rheinwerk Verlag (SAP PRESS), search “martin koch” · checked on 2026-11-05

  25. 25

    The tracer from iFlowTailor ↑Product · AuthTailor product documentation, README, section “Origin of the code” · checked on 2026-11-08

  26. 26

    iFlowTailor – workbench for SAP Cloud Integration ↑Vendor · iflowtailor.com · checked on 2026-11-08

Frequently asked

Short answers.

What is AuthTailor?
AuthTailor is a free browser extension that records a single sign-on login with SAML 2.0 or OpenID Connect, or reads pasted messages. It takes tokens apart, checks signatures and every step of the flow, and shows why the login fails. It is made by CloudDNA GmbH from Austria.
What does AuthTailor cost?
Nothing. There is no account, no licence and no paid feature. If you want help setting up single sign-on or a workshop, you can engage CloudDNA for that – that is a separate offer.
Does CloudDNA see my tokens or recordings?
No. AuthTailor has no server, no telemetry and no analytics. Recordings and pasted content stay in the panel’s memory only while it is open. The one outbound request fetches the token issuer’s public keys when you click.
Do I need SAP to use AuthTailor?
No. The tracer works with any identity provider and any app that speaks SAML 2.0, OpenID Connect or OAuth 2.0 in the browser. The SAP tab is an extra for everyone working on SAP BTP with XSUAA, IAS and destinations.
Which browsers does AuthTailor support?
Chrome; the build also produces packages for Microsoft Edge and Firefox. Publication in the Chrome Web Store is under way – until then, the extension is available on request as a package.
Is AuthTailor an SAP product?
No. AuthTailor is a product of CloudDNA GmbH and works with identity providers and apps from any vendor. It changes nothing in them and does not replace their logs.

Your question isn’t here? Talk to me: +43 664 1964199 office@clouddna.at Get in touch

Contact

Login stuck? Talk to us.

AuthTailor is free. If you need help – setting up single sign-on on SAP BTP, with a stubborn error or for a workshop with your team – get in touch. I reply within one working day, personally.

Martin KochManaging Director, CloudDNAI read every request myself and reply personally.

Get in touch +43 664 1964199 office@clouddna.at