Question 1

What is ProtocolSoup?

Accepted Answer

ProtocolSoup is a free, live execution platform for authentication and identity protocols. Execute real OAuth 2.0, OpenID Connect, OID4VCI, OID4VP, SAML 2.0, SPIFFE/SPIRE, SCIM 2.0, and SSF flows against live infrastructure, inspect every HTTP exchange, and decode tokens in real time.

Question 2

How do I test OAuth 2.0 flows?

Accepted Answer

ProtocolSoup lets you execute real OAuth 2.0 flows — Authorization Code, Authorization Code + PKCE, Client Credentials, Refresh Token, Token Introspection, and Token Revocation — against a working authorization server. You see every request, response, header, and token as it happens.

Question 3

What is the difference between OAuth 2.0 and OpenID Connect?

Accepted Answer

OAuth 2.0 is an authorization framework that grants delegated access to resources. OpenID Connect (OIDC) is an authentication layer built on OAuth 2.0 that adds an ID token containing verified user identity claims. OAuth answers "what can this app access?" while OIDC answers "who is this user?"

Question 4

What are verifiable credentials and how do OID4VCI and OID4VP work?

Accepted Answer

Verifiable credentials are tamper-evident digital credentials (like diplomas or licenses) that a holder can present to a verifier. OID4VCI (OpenID for Verifiable Credential Issuance) defines how an issuer delivers credentials to a wallet. OID4VP (OpenID for Verifiable Presentations) defines how a verifier requests and validates credential presentations from a wallet.

Question 5

What is the ProtocolSoup wallet harness?

Accepted Answer

The hosted wallet at wallet.protocolsoup.com is a real OID4VCI and OID4VP wallet used by Looking Glass. It issues and presents mdoc and SD-JWT verifiable credentials, including HAIP client and key attestation, instead of simulating wallet behavior in the browser.

Question 6

What is PKCE and why is it required for OAuth 2.0?

Accepted Answer

PKCE (Proof Key for Code Exchange, RFC 7636) prevents authorization code interception attacks by binding the token request to the original authorization request via a code_verifier/code_challenge pair. It is required for public clients (SPAs, mobile apps) and recommended for all OAuth 2.0 clients.

Question 7

How is SAML different from OAuth and OIDC?

Accepted Answer

SAML 2.0 is an XML-based federation protocol primarily used for enterprise single sign-on (SSO) between identity providers and service providers. OAuth 2.0 and OIDC are JSON/REST-based protocols designed for API authorization and modern web/mobile authentication. SAML predates OAuth and is common in enterprise environments.

Question 8

What is SPIFFE and how does it provide zero-trust workload identity?

Accepted Answer

SPIFFE (Secure Production Identity Framework For Everyone) provides cryptographic identities to workloads in distributed systems. SPIRE is the reference implementation that issues X.509-SVIDs and JWT-SVIDs, enabling mTLS between services and automatic certificate rotation — the foundation for zero-trust service mesh architectures.

Question 9

What is SCIM 2.0 and how does it automate user provisioning?

Accepted Answer

SCIM 2.0 (System for Cross-domain Identity Management, RFC 7644) is a REST API standard for automating user and group provisioning across identity domains. It supports create, read, update, delete operations, filter queries, bulk operations, and schema discovery.

Question 10

What is the Shared Signals Framework (SSF)?

Accepted Answer

SSF enables real-time security event sharing between cooperating systems using Security Event Tokens (SETs). It includes CAEP (Continuous Access Evaluation Protocol) for session signals and RISC (Risk Incident Sharing and Coordination) for account compromise signals — essential for zero-trust continuous authorization.

ProtocolSoup

Real Protocol Execution

Full Traffic Inspection

Live Artifact Decoding

Start here

Looking Glass

Protocol Reference

Wallet Harness

Supported Protocols

Specifications