client_id / client_secret Validator

The OAuth 2.0 client credential pair has no format defined by the specification: each provider picks its own. That means no universal validation exists — but there are characteristics separating a healthy credential from one that will cause trouble, and those are what you can check before pasting them into a configuration file.

Paste both values and the page flags what stands out: an identifier that is too short, a secret below the length expected of a value with reasonable entropy, and characters outside the URL-safe set. That last one matters because credentials may travel encoded in the authorisation header or in a form body, and a character needing escapes is a recurring source of intermittent failure.

Be clear about what the check does not do: it measures shape, not secrecy. A long, well-formatted secret can be weak for having been generated from a predictable source, and no inspection of the value reveals that. Real security comes from the provider generating it with a cryptographic source, from the secret never reaching a repository or a browser, and from rotating it periodically.