免费 · 浏览器本地工具Free · browser-local tool

Don't paste the token.
Compare the contract.

Load an OpenAPI JSON document locally, name the operations this client actually calls, and paste scope names—not a token. The tool compares only declared OAuth/OpenID requirements and surfaces missing declarations, missing grant names and possible excess for human review.

Compare one API contract Check evidence

Free · browser-only

Local OpenAPI scope comparer

OpenAPI JSON fileParsed in browser memory; maximum 2 MB. Use a redacted/public spec if operation paths or scope names are sensitive. Operations this client needs

<small>One METHOD + exact OpenAPI path per line. Leave blank to review all documented operations.</small></label>
    <label class="wide">Granted scope names<textarea id="granted-scopes" maxlength="12000" placeholder="contents:read
issues:write"><small>Names separated by newline, comma or whitespace. Never paste an access/refresh token, Authorization header, client secret or JWT.</small></label>
    <div class="wide row-actions"><button class="btn" id="sample" type="button">Load fictional OpenAPI</button><button class="btn light" id="clear" type="button">Clear local document</button></div>
    <button class="btn wide" id="run" type="button">Compare declared scopes</button></form>
      <section class="tool-results" aria-live="polite">
    <div class="metric hero-metric"><span>Current gate</span><b id="status">LOAD AN OPENAPI JSON</b></div>
    <div class="metric"><span>Selected operations</span><b id="operation-count">0</b></div>
    <div class="metric"><span>Assessable</span><b id="assessable-count">0</b></div>
    <div class="metric"><span>Missing grant</span><b id="missing-count">0</b></div>
    <div class="metric"><span>Possible excess</span><b id="extra-count">0</b></div>
    <div class="wide-metric matrix-wrap"><table class="boundary-table"><thead><tr><th>Operation</th><th>Declared alternatives</th><th>Best comparison</th><th>Status</th></tr></thead><tbody id="scope-table"><tr><td colspan="4">No OpenAPI document loaded.</td></tr></tbody></table></div>
    <div class="wide-metric"><h3>Contract warnings</h3><ul class="result-list" id="warnings"></ul></div>
    <button class="btn light wide-metric" type="button" id="copy">Copy local matrix CSV</button>
    <p class="result-note">The paid pack sends selected operation labels and scope names to this service to render Markdown; it never receives the OpenAPI file or any token. Redact labels first if they expose internal design.</p></section></div>
    <p class="legal-note">Authorization boundary: this tool sees declarations, not enforcement. It cannot verify token signature, issuer, audience, subject, resource, expiration, consent, downstream IAM permissions or actual server behavior. Never paste a token or secret. Treat missing or incorrect OpenAPI security metadata as unassessable, not safe.</p>
  </div></section>
  <section class="section paid-section"><div class="wrap paid-grid">
    <div><div class="eyebrow">Paid · one-time</div><h2>$11 Scope Review Pack</h2>
      <p class="lede">Generate a Markdown operation-to-scope workpaper with alternatives, missing/excess candidates, specification checks, server-rejection tests and an owner decision record. The submitted scenario contains labels and scope names only—not the source file or token.</p><ul><li>Operation-level OAuth/OpenID scope alternatives</li><li>Missing-grant and possible-excess review candidates</li><li>Spec version, provider documentation and enforcement tests</li><li>Keep, narrow, split-token, fix-spec or escalate decision record</li></ul>
    </div>
    <aside class="pay-card" id="paywall"><div class="number">$11</div><p>$11 once. Review or redact operation paths and scope names before generating; no token, client secret or OpenAPI file is sent.</p><button class="btn" id="buy" onclick="buy()">Unlock with Stripe</button><small>Safe checkout; pricing and renewal terms are shown before payment.</small></aside>
    <aside class="pay-card" id="pro" hidden><span class="tag"><span data-lang-only="zh">已解锁 · 仅限当前 App</span><span data-lang-only="en">unlocked · apiauth-scope only</span></span><h3>Generate Current Plan</h3>
      <button class="btn" id="pack-btn" onclick="pack()"><span data-lang-only="zh">生成付费报告包</span><span data-lang-only="en">Generate Scope Review Pack</span></button><button class="btn light" id="download" hidden><span data-lang-only="zh">下载 .md 文件</span><span data-lang-only="en">Download .md</span></button><pre id="pack-out"></pre></aside>
  </div></section>
  <section class="section" id="sources"><div class="wrap">
    <div class="section-head"><div><div class="eyebrow">Source ledger</div><h2>Authorization standards and platform substitutes</h2></div><p class="muted"><span data-lang-only="zh">先核对当前来源与工具边界</span><span data-lang-only="en">Check current sources and tool limits first</span></p></div>
    <div class="source-grid"><a class="card" href="https://www.rfc-editor.org/info/rfc6749/" target="_blank" rel="noopener"><b>OAuth 2.0 · RFC 6749</b><span>OAuth defines scope as the limited capability requested for an access token; provider semantics and enforcement still govern.</span></a><a class="card" href="https://spec.openapis.org/oas/latest.html" target="_blank" rel="noopener"><b>OpenAPI Specification</b><span>Security Requirement Objects can inherit globally or override per operation and can express alternative requirements.</span></a><a class="card" href="https://docs.github.com/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens" target="_blank" rel="noopener"><b>GitHub · Fine-grained token permissions</b><span>Strong provider-native substitute: endpoint documentation and response headers state required fine-grained permissions.</span></a><a class="card" href="https://developers.google.com/identity/protocols/oauth2/production-readiness/sensitive-scope-verification" target="_blank" rel="noopener"><b>Google · Sensitive scope verification</b><span>Strong provider-native process: sensitive/restricted scopes require use-case and data-access review.</span></a><a class="card" href="https://docs.aws.amazon.com/access-analyzer/latest/APIReference/Welcome.html" target="_blank" rel="noopener"><b>AWS · IAM Access Analyzer</b><span>Strong platform substitute for checking policies and refining least privilege with actual cloud policy context.</span></a></div>
  </div></section>
</main>
<footer class="wrap footer"><a href="/"><span data-lang-only="zh">← 查看全部工具</span><span data-lang-only="en">← Browse all tools</span></a><a href="#calculator"><span data-lang-only="zh">返回工具 ↑</span><span data-lang-only="en">Back to tool ↑</span></a></footer>
<style>
.tool-hero h1{font-size:clamp(54px,7.3vw,102px)}.tool-work{background:#15150f;color:white}.tool-grid{display:grid;grid-template-columns:.88fr 1.12fr;gap:18px}.tool-controls{display:grid;grid-template-columns:1fr 1fr;gap:13px;background:#202019;padding:24px;border:1px solid #434338}.tool-controls label{font-size:12px;font-weight:850;color:#ccccc1}.tool-controls label.wide,.tool-controls .wide{grid-column:1/-1}.tool-controls input:not([type="checkbox"]),.tool-controls select{width:100%;margin-top:7px;padding:12px;background:#10100d;color:white;border:1px solid #5f5f54;font:inherit;border-radius:0}.tool-controls small{display:block;color:#a9a99d;margin-top:7px;font-weight:400}.tool-controls .check{display:flex;align-items:center;gap:9px;border:1px solid #4d4d43;padding:12px;color:#deddd2}.tool-controls .check input{width:18px;height:18px}.tool-results{background:var(--acid);color:var(--ink);padding:24px;border:1px solid #4c4c40;display:grid;grid-template-columns:1fr 1fr;gap:1px}.metric{background:rgba(255,255,255,.56);padding:16px;display:flex;flex-direction:column}.metric span{font-size:10px;font-weight:950;text-transform:uppercase;letter-spacing:.06em}.metric b{font-size:26px;letter-spacing:-.05em}.metric b span{font-size:inherit;letter-spacing:inherit;text-transform:none}.hero-metric{grid-column:1/-1;background:var(--ink);color:white}.hero-metric b{font-size:clamp(34px,5vw,58px);line-height:1}.wide-metric{grid-column:1/-1}.result-list{grid-column:1/-1;background:#fff;padding:15px 18px;margin:0;list-style-position:inside}.result-list li{padding:8px 0;border-bottom:1px solid #d3d2c9}.result-note{grid-column:1/-1;font-size:12px;margin:14px 0 0}.tool-gate{padding:9px 12px;border:1px solid currentColor;font-size:12px;font-weight:950}.tool-gate.go{background:var(--acid);color:var(--ink)}.tool-gate.hold{background:var(--orange);color:var(--ink)}.paid-grid{display:grid;grid-template-columns:1.15fr .85fr;gap:38px;align-items:start}.paid-grid h2{margin:8px 0 18px}.pay-card{background:var(--white);border:2px solid var(--ink);padding:28px;box-shadow:9px 9px 0 var(--orange)}.pay-card .number{font-size:104px}.pay-card small{display:block;margin-top:18px}.pay-card pre{white-space:pre-wrap;max-height:460px;overflow:auto;font:12px/1.5 ui-monospace,SFMono-Regular,Menlo,monospace;background:var(--black);color:var(--acid);padding:14px}.source-grid{display:grid;grid-template-columns:1fr 1fr;gap:12px}.source-grid a{text-decoration:none;display:flex;flex-direction:column;gap:8px}.source-grid a:hover{border-color:var(--blue)}.source-grid span{font-size:13px;color:var(--muted)}.legal-note{font-size:12px;color:#b9b8ad;margin-top:18px}
@media(max-width:760px){.tool-grid,.paid-grid,.source-grid{grid-template-columns:1fr}.tool-controls,.tool-results{grid-template-columns:1fr}.tool-controls label.wide,.tool-controls .wide,.hero-metric,.wide-metric,.result-list,.result-note{grid-column:auto}.hero-metric b{font-size:40px}}
.tool-controls input,.tool-controls textarea{width:100%;margin-top:7px;padding:12px;background:#10100d;color:white;border:1px solid #5f5f54;font:inherit;border-radius:0}.tool-controls textarea{min-height:105px}.row-actions{display:flex;gap:10px;flex-wrap:wrap}.matrix-wrap{overflow:auto}.boundary-table{width:100%;border-collapse:collapse;background:white;font-size:12px}.boundary-table th,.boundary-table td{padding:10px;border:1px solid #c8c7bc;text-align:left;vertical-align:top}.tool-results h3{margin:18px 0 0}.tool-results .btn{margin-top:14px}</style>
<script>
const APP="apiauth-scope";
const $=id=>document.getElementById(id);
const num=(id,f=0)=>{const v=Number($(id).value);return Number.isFinite(v)?v:f};
const money=(n,d=2)=>new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",minimumFractionDigits:d,maximumFractionDigits:d}).format(Number(n)||0);
function event(kind,data={}){fetch("/api/events",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({app:APP,kind,data}),keepalive:true}).catch(()=>{})}

Don't paste the token.Compare the contract.

Local OpenAPI scope comparer

Don't paste the token.
Compare the contract.