How do I mock the Google OAuth2 API locally?

Install stunt, add a one-service block to stunt.yaml (adapter: embedded:google-style), and run stunt up. You get a local, stateful stand-in for Google OAuth2 API v2 — 4 routes over rest — with no remote account, no network, and no bills.

Is the Google OAuth2 API mock data synthetic?

Yes — entirely. The adapter returns generated data only; stunt's adapter lint rejects real-looking secrets and PII at build time. It simulates the shape and behavior of Google OAuth2 API (routes, status codes, pagination, webhooks), never real records.

← all adapters

google-style

simulates Google OAuth2 API v2

restadapter v0.1.04 routes

verification

SDKverified with x/oauth2 v0.36.0verified with google-api-go-client/idtoken v0.293.0· surface 4 · not implemented 2 · differs 2

use it

# add to stunt.yaml
services:
  google:
    adapter: embedded:google-style

# then
$ stunt up

The embedded: source extracts this adapter from the binary — no git clone, fully offline.

how to mock the Google OAuth2 API locally

Install stunt, paste the service block above into stunt.yaml, run stunt up — then point your client at localhost instead of Google OAuth2 API. It works offline, keeps state across requests and restarts, and every response is synthetic: the route shapes, status codes, pagination, and webhook delivery follow the real Google OAuth2 API v2 surface — the data is fake, the behavior is real.

backing stores

tokensrefresh_tokenscodes

api surface (4)

generated from the adapter manifest — exactly what boots, nothing more

4 routes

GET/o/oauth2/auth

POST/o/oauth2/token

GET/oauth2/v3/certs

GET/oauth2/v3/userinfo

SDK-verified behaviors (7)

✓authorize redirect mints a single-use code
✓authorization-code exchange -> tokens + id_token
✓idtoken.Validate verifies the adapter's RS256 id_token via its JWKS
✓tampered id_token rejected by idtoken.Validate
✓refresh grant rotates the access token
✓userinfo honors the refreshed token
✓adapter serves a real JWKS

Not implemented (2)

No revoke or tokeninfo endpoints
No device-code grant (/device.code) or OIDC discovery document

Differs from the real API (2)

Authorize auto-approves with an instant 302; no consent screen
id_tokens signed by a fixed synthetic RSA key (kid mock-google-key-1)

full scorecard →

want more of the Google OAuth2 API surface? adapters are YAML + Starlark — the authoring guide covers adding routes, fixtures, and state machines. Open an issue for anything big first, or just file a PR — merged routes ship in the next release.