Why does the recording show no token response?

Browsers do not let extensions read response bodies. For the token response, paste a HAR from the DevTools or use the Also bearer tokens option.

Does AuthTailor work in Firefox?

Yes, from Firefox 115 – as a package on request via the contact form. There the panel opens as a sidebar instead of a side panel.

Can I save a recording?

Not in the panel – recordings stay in memory only. With Save cleaned HAR or Copy report you take the result with you, masked.

Troubleshooting

Most of the panel’s messages already say what to do. Here they are collected – with cause and fix.

Recording: 30 minutes, 300 requests at most
Files: up to 60 MB
Firefox: version 115 or later
Help from people: CloudDNA

The recording shows nothing

Running recording with the line Log in now in a tab and the message Waiting for the first login request, 2 requests were seen in tabs, none of them SAML, OAuth or OIDC — The browser sees requests, but no login.

How many requests the browser has seen in tabs altogether. If there is a number here, recording works.
“Waiting for the first login request …” – none of them has been SAML, OAuth or OIDC so far.

Message or sign	Cause and fix
“… requests were seen in tabs, none of them SAML, OAuth or OIDC.”	The login has not started yet, or you are already logged in and the browser passes straight through. Log out or use a private window and trigger the login again.
“Without the permission the browser cannot record – paste or drop a HAR instead.”	Access to all https sites was refused. Click Record live again and allow it, or paste a HAR.
“The browser granted the permission but does not provide the recording yet …”	Reload the extension once (`chrome://extensions`) and start again.
“Nothing recorded.”	The recording was stopped before a login request arrived.
The recording stops by itself	After 30 minutes or 300 requests. Record again starts a new one.
The recording is gone	Recordings stay in memory only while the panel is open. Closing the panel means: recording gone.

The token response is missing

The live capture cannot see response bodies – browsers do not allow that for extensions. So the token response with ID token and access token does not appear. What helps:

Switch on Also bearer tokens: then you see the access token in the API calls.
Export a HAR from the DevTools and paste it – it includes response bodies, see Paste and examples.

No token shows up with SAP BTP

With Integration Suite, Build Work Zone and other apps behind an SAP App Router, this is not a recording problem: the App Router redeems the code at XSUAA on the server, and the browser only gets a session cookie. A HAR or Also bearer tokens does not change that.

Across the flow then shows SAP App Router: the token stays on the server – with subaccount, region, XSUAA client, trust (origin) and IdP.
Notes such as No state – how the SAP App Router works or No PKCE – confidential client are SAP standard, not a weakness of the app.
Next: check the role collections in the BTP cockpit, and for a 403 paste a token from a service key – see SAP.
Errors between IAS and the corporate IdP: with OIDC they are in the IAS Troubleshooting Logs and the corporate IdP’s sign-in logs – see SAP.

An input is not recognised

Message or sign	Cause and fix
Verdict Nothing recognised	The input is neither SAML nor a JWT, URL, token response, HAR or known error message. Often a piece got lost when copying – copy the whole value, for SAML the value of the `SAMLResponse` parameter. Passkeys, certificates, CSP and CORS belong in Tools, SAP artefacts in SAP.
“File is larger than 60 MB.”	Export a smaller HAR: clear the list in the DevTools first and record only the login.
“This is not valid JSON.” / “No HAR: log.entries is missing.”	In Clean HAR: the file is cut off or not a HAR. Export it again.

The keys cannot be loaded

“Could not load the keys from … (…). Paste the JWKS together with the token instead.” The issuer cannot be reached from your network, has no discovery at /.well-known/openid-configuration or does not allow the request. What helps: paste the JWKS (the response of jwks_uri) together with the token, or a HAR that contains it. If the seal shows Key missing in the JWKS, the issuer has rotated its keys – or the token comes from a different tenant.

The page storage cannot be scanned

Message	Cause and fix
“The panel may not read this tab yet …”	Open the panel on that tab with the toolbar icon, or click Allow access and scan – access is returned right afterwards.
“Browser pages and the extension store cannot be scanned.”	The browser does not allow it. Switch to the app and scan again.
“Access was not granted – nothing was scanned.”	Click again and allow access.

The panel

The icon opens nothing: in Chrome and Edge the icon opens the side panel. If you cannot see it, pin it via the puzzle icon. In Firefox 115 or later, AuthTailor opens as a sidebar.
Wrong language: AuthTailor follows the browser’s language. You can switch it at the top of the panel, see Getting started.
Reset settings: under About, see Permissions and privacy.

Still stuck?

CloudDNA is behind AuthTailor. If a login still does not work despite the finding – in a grown SAP landscape, for example – people can help. Never send real tokens, passwords or unchecked HAR files.