Are My API Credentials Safe?

Short answer: yes, completely safe. This site is a fully static site — there is no server-side code, no database, and no backend. Anything you type into this page stays in your browser and is never transmitted to any server.

Try it here

Fill in your credentials below. They'll be pre-filled in every code example across the API docs whenever you visit a page — no copy-pasting placeholder values.

The API documentation on this site lets you enter your OneLogin subdomain, Access Token, Client ID, and Client Secret so that the code examples on each page auto-fill with your real values — making them easier to copy and run directly.

developers.onelogin.com vs onelogin.com

It’s worth being clear about the difference between this site and your actual OneLogin tenant:

developers.onelogin.com (this site) is a fully static site — pre-built HTML, CSS, and JavaScript files served directly by a CDN. There is no web server, no database, no application backend, and no server-side code. It is physically incapable of receiving or transmitting user input. Anything you type here never leaves your browser.
onelogin.com (your actual OneLogin tenant) is a live web application that transmits and processes data — including credentials, login events, and API calls. That is its purpose. Do not confuse the two.

How each credential is handled

Field	Storage	Clears when
Subdomain	`localStorage`	You click “Clear saved data” or clear site data
Access Token	`sessionStorage`	Tab or browser closes
Client ID	Memory only — never stored	Page navigation
Client Secret	Memory only — never stored	Page navigation

Client ID and Client Secret are intentionally never written to any storage. They are kept only in the JavaScript memory of the current page. They appear only on the Generate Tokens page, which is the only place you need them to construct a working curl command.

What actually happens when you type

You type a value into the widget.
JavaScript running in your browser tab does a simple text substitution in the code blocks on the page — exactly like a local find-and-replace.
Depending on the field, the value is either saved in localStorage, held in sessionStorage, or not saved at all (see table above).
No network request is made. There are no form submissions, no POST requests, and no analytics on these fields.

How to verify this yourself

Open your browser’s Developer Tools (F12), go to the Network tab, and type something into the widget. You will see zero outbound requests.

You can also read the full source of /js/placeholder-replacer.js — it is a small, unminified, dependency-free file.

How to clear your saved values

Click the Clear saved data button in any credentials widget. This removes the subdomain from localStorage and the access token from sessionStorage.

You can also open Developer Tools → Application → Local Storage / Session Storage → https://developers.onelogin.com and delete keys prefixed with ol_cred_. Using a private/incognito window will prevent anything from persisting between sessions.

Recommendations

Use these fields freely in any personal or development environment.
On a shared or public computer, click Clear saved data before you leave, or use an incognito window.
Client ID and Client Secret are never saved anywhere by this site, so you don’t need to worry about clearing them.
Access Token and Client Secret inputs are masked by default — use the show/hide toggle only when needed.