Build a Mock OIDC Userinfo Endpoint in Python with Flask

Create a local mock OIDC userinfo endpoint in Flask that returns a standard JSON user payload, ideal for testing auth flows without a real identity provider.

Easy Python 3.9+ Aug 9, 2026 Auth & security at scale 13 views 0 copies

flask oidc userinfo mocking jwt
Requires third-party packages — install first
pip install flask

Python code

17 lines
Python 3.9+ 
from flask import Flask, jsonify

app = Flask(__name__)

@app.route("/userinfo")
def userinfo():
    mock_user = {
        "sub": "1234567890",
        "name": "John Doe",
        "email": "john@example.com",
        "email_verified": True,
        "groups": ["admin", "dev"]
    }
    return jsonify(mock_user)

if __name__ == "__main__":
    app.run(port=5000)

Output

stdout 
* Serving Flask app 'app'
 * Debug mode: off
 * Running on http://127.0.0.1:5000 (Press CTRL+C to quit)

When you hit http://127.0.0.1:5000/userinfo:
{
  "sub": "1234567890",
  "name": "John Doe",
  "email": "john@example.com",
  "email_verified": true,
  "groups": ["admin", "dev"]
}

How it works

The Flask route decorator binds /userinfo to the function, so visiting that path executes userinfo() and returns the dict as JSON via jsonify. The sub claim is the standard OIDC subject identifier—unique for each user. This mock endpoint lets you develop against a standard OIDC response shape without standing up a full identity provider. The server runs on port 5000 by default; change it in app.run() if needed

Common mistakes

  • Forgetting to add `debug=True` in `app.run()` may cause misleading errors during development. Actually, debug is fine to leave off, but include it if you want auto-reload.
  • Returning a plain dict without `jsonify` yields a Flask error because the response must be a string, tuple, or Response object—not a dict.
  • Not setting `Content-Type: application/json` explicitly; `jsonify` does it for you, but if you return a string you must set the header yourself.

Variations

  1. Use `make_response` and set headers manually for more control over the response object.
  2. Add an `Authorization: Bearer <token>` check to simulate real OAuth validation before returning the mock user.

Real-world use cases

  • Testing frontend apps that rely on OpenID Connect userinfo endpoints without depending on a live identity provider in CI.
  • Simulating an authentication server locally for integration tests of microservices that fetch user profile data.
  • Providing a consistent mock user payload for unit tests that validate how your application maps OIDC claims to internal models.

Sponsored

Run locally

This sample needs third-party packages, so it cannot run in the browser IDE. Copy the code above, install the packages shown at the top, then run it in your own Python environment.

More from Auth & security at scale

Keep learning

Related tutorials and quizzes for this topic.

Tutorials

Quizzes