OAuth2 Authorization URL Builder

The first leg of OAuth 2.0 is a redirect to the provider's authorization endpoint carrying half a dozen query parameters. One wrong character in redirect_uri, or a missing state, and you get a generic provider error screen with no hint about what was wrong. Fill in the endpoint, response_type, client_id, redirect_uri, scope and state, and the URL comes out assembled and encoded.

Encoding follows the form-urlencoded rules, so spaces become plus signs: openid profile email turns into scope=openid+profile+email. That is valid, and the provider decodes it the same as %20. If the endpoint you paste already carries a query string, the parameters are appended with an ampersand rather than a question mark. All six fields go into the URL even when blank, so delete the ones you are not using before pasting into a browser.

What you get is the bare RFC 6749 shape. Two parameters that are close to mandatory today are missing: code_challenge and code_challenge_method from PKCE, which OAuth 2.1 asks for even from confidential clients, and nonce, which OpenID Connect requires whenever response_type includes id_token. Add them by hand. The implicit flow, response_type=token, has been discouraged for years. state must be random per request and verified on the way back. Nothing leaves your browser.