A WireMock simulation of Google's REST API — covering OAuth 2.0 sign-in, token issuance, the device flow, and token revocation.
A shared instance of this template runs on a public endpoint — call it right now from curl, an SDK, or an AI agent. Responses are fixed examples and behavior can't be changed; rate limits apply.
Jump to the endpoints ↓Run this template as a mock API in WireMock Cloud for a private instance you control — edit stubs, add stateful scenarios, use dynamic response templating, and inspect requests in the log.
Open in WireMock Cloud (free) →Live sandbox · no signup, no API key
A running WireMock Cloud instance of this template, callable right now from a terminal, a script, or an AI agent.
Endpoints
GET Get Google's public JWKS
curl -s -X GET 'https://jy806.wiremockapi.cloud/oauth2/v3/certs'POST Start a device authorization flow
curl -s -X POST 'https://jy806.wiremockapi.cloud/device/code'POST Revoke a token
curl -s -X POST 'https://jy806.wiremockapi.cloud/revoke'Spec catalog — Google Sign-In / OAuth 2.0 API (2.0) · 11 endpoints
| Method | Path | Summary |
|---|---|---|
| GET | /.well-known/openid-configuration | OpenID Connect Discovery |
| GET | /assets/{assetId} | Get assets by assetId. |
| POST | /device/code | Device Authorization Endpoint |
| GET | /favicon.svg | Get favicon.svg. |
| GET | /images/{imageId} | Get images by imageId. |
| GET | /o/oauth2/v2/auth | Authorization Endpoint |
| GET | /oauth2/v3/certs | JSON Web Key Set |
| POST | /revoke | Token Revocation Endpoint |
| GET | /test | Get test. |
| POST | /token | Token Endpoint |
| GET | /v1/userinfo | UserInfo Endpoint |
Unauthenticated WireMock Cloud demo sandbox for Google — not an official Google sandbox, and it returns simulated example data only.
This mock reproduces Google's OAuth 2.0 login surface with its browser half intact — the authorization endpoint at /o/oauth2/v2/auth returns a styled mock Google sign-in page, not a JSON placeholder. Completing it and exchanging the code yields Google's token response shape: a bearer access_token beside an RS256-signed id_token that verifies against the certs document at /oauth2/v3/certs.
It's a lookalike served by stubs — deliberately so. No Google account is involved and nothing you type leaves the mock, which lets UI tests drive a convincing sign-in screen without touching accounts.google.com or tripping bot detection.
Their default verifiers won't, because they fetch Google's production certificates and pin the accounts.google.com issuer. The token's signature is genuine RS256, though — verification succeeds in any JWT library you point at the sandbox's certs endpoint, with issuer checks aimed at the mock.
POST device/code answers immediately with the full device-authorization payload — user code, verification URL, a five-second polling interval, a thirty-minute expiry — as fixed values. That makes the happy path of a TV-or-CLI sign-in testable without a second device or a countdown actually elapsing.
The shared mock always says yes. Denials, expired codes, and revoked-consent responses are exactly one stub each in your own WireMock Cloud copy of the template — define the error JSON Google would send, and your recovery UX becomes a repeatable test case.
Vendor names identify APIs represented by WireMock template sources. This page does not imply vendor endorsement, certification, partnership, or official integration status.