Identity Provider
The MinuteMail Identity Provider (IDP) is a mock OAuth 2.0 / OpenID Connect provider. It lets you test your application’s “Sign in with Google/GitHub/Apple/Facebook” flows end-to-end — without registering a real OAuth app or involving real users.
What it does
Section titled “What it does”With the mock IDP you can:
- Register OAuth clients that look like Google, GitHub, Apple, or Facebook logins to your app
- Create mock identities linked to real MinuteMail mailboxes, controlling the email, name, and username your app sees
- Run the full authorization code flow — consent screen, authorization code, token exchange, userinfo — exactly as your production flow would behave
Because identities are linked to MinuteMail mailboxes, any “welcome” or “verify your email” messages your app sends during sign-up land in a mailbox you can read from the web interface or via the API. This makes the IDP useful for testing complete signup pipelines, not just the login button.
How it works
Section titled “How it works”- Register a client in the MinuteMail dashboard — you get a client ID, client secret, and choose the provider it impersonates (including its logo on the consent screen). See Clients & Identities.
- Create mock identities for that client, each linked to one of your MinuteMail mailboxes.
- Point your app at the IDP’s OAuth endpoints at
https://minutemail.co/idp/...instead of the real provider. The flow is described in OAuth Flow.
When your app redirects to the authorize endpoint, MinuteMail shows a consent screen listing the identity that will be used. Approving it returns an authorization code to your app, which exchanges it for an access token (and, with the openid scope, an ID token) and calls the userinfo endpoint — the same sequence as a real provider.
Key characteristics
Section titled “Key characteristics”| Protocol | OAuth 2.0 authorization code flow, with optional PKCE (S256) |
| OpenID Connect | ID tokens signed with RS256 when openid scope is requested |
| Scopes | openid, email, profile |
| Authorization code lifetime | 10 minutes, single-use |
| Access token lifetime | 1 hour, Bearer token |
| Public endpoints | https://minutemail.co/idp/oauth/authorize, /idp/oauth/token, /idp/oauth/userinfo |
The public OAuth endpoints are unauthenticated — anyone can start a flow, but only clients and identities registered in your account can complete one. Client and identity management happens in the authenticated web dashboard.
Limits
Section titled “Limits”The number of mock identities per account is limited by your plan (mock_identities quota). Your current usage is shown on the Identity Providers page in the dashboard. When you hit the limit, creating new identities fails until you delete unused ones or upgrade.