Mock an OAuth2 token response

A POST mock that returns an RFC 6749-shaped token response with a fresh access_token and refresh_token.

Stands in for a third-party API endpoint.

Response payload

{
  "access_token": "{{faker.uuid}}",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "{{faker.uuid}}",
  "scope": "read write"
}

Fields worth knowing

Field	What it means
access_token	A fresh UUID on every call via {{faker.uuid}} — not a real signed token.
token_type	Hardcoded to Bearer.
expires_in	A hardcoded lifetime in seconds; edit it to test expiry handling.
refresh_token	A fresh UUID via {{faker.uuid}}.
scope	Space-separated scopes granted; edit it to test scope-gated logic.

Create the mock

curl -X POST https://quickmock.dev/api/mocks \
  -H 'Content-Type: application/json' \
  -d '{
  "method": "POST",
  "response_status": 200,
  "content_type": "application/json",
  "response_body": "{\"access_token\":\"{{faker.uuid}}\",\"token_type\":\"Bearer\",\"expires_in\":3600,\"refresh_token\":\"{{faker.uuid}}\",\"scope\":\"read write\"}"
}'

Call it

curl -X POST https://quickmock.dev/m/<slug>

What you get

POST /m/<slug> -> 200 an RFC 6749-shaped token response
access_token/refresh_token are fresh UUIDs each call

How this differs from the real thing

access_token and refresh_token are just fresh UUIDs, not real signed JWTs, and the mock never checks client_id, client_secret, or an authorization code — it always returns the same successful response.

Ready to use it?

Open it in the mock builder to tweak first

Pairs well with this guide: Mock a REST API endpoint

← All templates