Special test addresses

Special test addresses · Generic

Log in as any of these with you@example.com’s password. No extra signup is needed. Each address is its own stable test user, and its behavior is always the same. Combine tags with dots, for example you+unverified.noname@example.com.

Provider

Address	Behavior
`you+unverified@example.com`	The email is reported as unverified (email_verified: false).
`you+renamed@example.com`	Same subject (sub) as the address without +renamed, but a different email, as if the user changed it.
`you+noname@example.com`	No name claim.
`you+badcode@example.com`	The authorization code exchange returns invalid_grant.
`you+down@example.com`	The token endpoint returns 503 Service Unavailable.
`you+flaky@example.com`	The first exchange of each code returns 503; retrying with the same code succeeds.
`you+slow@example.com`	The token endpoint responds only after a delay (10 seconds by default).
`you+hd@example.com`	A Workspace user. The ID token includes hd with the email's domain.
`you+unverified@example.com`	The email is reported as unverified (email_verified: false).
`you+renamed@example.com`	Same subject (sub) as the address without +renamed, but a different email, as if the user changed it.
`you+noname@example.com`	No name, given_name, or family_name claims.
`you+firstname@example.com`	Only a first name: name and given_name, no family_name.
`you+returning@example.com`	A user who already consented. Same subject as the address without +returning, and access_type=offline returns no refresh token unless the app sends prompt=consent.
`you+revoked@example.com`	Sign-in works, but every refresh returns invalid_grant, as if access was revoked.
`you+badcode@example.com`	The authorization code exchange returns invalid_grant.
`you+down@example.com`	The token endpoint returns 503 Service Unavailable.
`you+flaky@example.com`	The first exchange of each code returns 503; retrying with the same code succeeds.
`you+slow@example.com`	The token endpoint responds only after a delay (10 seconds by default).
`you+blocked@example.com`	After login, shows Google’s “Access blocked” page with admin_policy_enforced instead of consent.
`you+renamed@example.com`	Same subject (sub) as the address without +renamed, but a different email, as if the user changed it.
`you+noname@example.com`	No name claim. preferred_username is still sent.
`you+personal@example.com`	A personal Microsoft account (tid 9188040d-6c67-4c5b-b112-36a304b66dad). Refused when the app’s tenant is organizations or a specific tenant, unless also +guest.
`you+noemail@example.com`	No email claim, like an account without a mailbox. preferred_username still holds the sign-in name.
`you+guest@example.com`	An invited guest when the app’s tenant is a specific tenant: tid and iss name that tenant, idp names the guest’s home tenant, and oid differs from the user’s own. Can be combined with personal.
`you+outsider@example.com`	Not a member or guest of the app’s tenant: a single-tenant app refuses the sign-in with AADSTS50020.
`you+revoked@example.com`	Sign-in works, but every refresh returns invalid_grant, as if access was revoked.
`you+mfa@example.com`	Sign-in works, but every refresh returns invalid_grant with AADSTS50076 and a claims challenge, as if a conditional access policy now requires MFA. The app must send the user to sign in again.
`you+throttled@example.com`	Sign-in works, but every refresh returns 429 Too Many Requests with a Retry-After header.
`you+badcode@example.com`	The authorization code exchange returns invalid_grant.
`you+down@example.com`	The token endpoint returns 503 Service Unavailable.
`you+flaky@example.com`	The first exchange of each code returns 503; retrying with the same code succeeds.
`you+slow@example.com`	The token endpoint responds only after a delay (10 seconds by default).
`you+blocked@example.com`	After login, shows Microsoft’s “Need admin approval” page instead of consent.
`you+unverified@example.com`	The primary email is unverified (verified: false in /user/emails).
`you+renamed@example.com`	Same id and login as the address without +renamed, but a different email, as if the user changed it.
`you+noname@example.com`	name is null, as for a user who never set one. Apps usually fall back to the login.
`you+private@example.com`	The email is private: /user returns email: null, so the app must read /user/emails (which needs the user:email scope).
`you+revoked@example.com`	Sign-in works, but every refresh returns bad_refresh_token, as if access was revoked. GitHub issues a refresh token only for offline_access.
`you+badcode@example.com`	The authorization code exchange returns invalid_grant.
`you+down@example.com`	The token endpoint returns 503 Service Unavailable.
`you+flaky@example.com`	The first exchange of each code returns 503; retrying with the same code succeeds.
`you+slow@example.com`	The token endpoint responds only after a delay (10 seconds by default).
`you+renamed@example.com`	Same subject (sub) as the address without +renamed, but a different email, as if the user changed it.
`you+hidden@example.com`	Hide My Email: the app gets a stable @privaterelay.appleid.com address with is_private_email: true.
`you+strings@example.com`	email_verified and is_private_email are the strings "true" and "false", which Apple sends instead of booleans for some users. is_private_email is "false" for a real address.
`you+returning@example.com`	A user who already signed in to this app. Same subject as the address without +returning, but Apple sends no user field, so the app gets no name.
`you+revoked@example.com`	Sign-in works, but every refresh returns invalid_grant, as if access was revoked.
`you+badcode@example.com`	The authorization code exchange returns invalid_grant.
`you+down@example.com`	The token endpoint returns 503 Service Unavailable.
`you+flaky@example.com`	The first exchange of each code returns 503; retrying with the same code succeeds.
`you+slow@example.com`	The token endpoint responds only after a delay (10 seconds by default).
`you+unverified@example.com`	The email is unverified (verified: false in /users/@me).
`you+renamed@example.com`	Same id and username as the address without +renamed, but a different email, as if the user changed it.
`you+noname@example.com`	global_name is null, as for a user who never set a display name. Apps usually fall back to the username.
`you+noemail@example.com`	No email: /users/@me returns email: null and verified: false with the email scope, like an account registered with a phone number.
`you+revoked@example.com`	Sign-in works, but every refresh returns invalid_grant, as if access was revoked.
`you+badcode@example.com`	The authorization code exchange returns invalid_grant.
`you+down@example.com`	The token endpoint returns 503 Service Unavailable.
`you+flaky@example.com`	The first exchange of each code returns 503; retrying with the same code succeeds.
`you+slow@example.com`	The token endpoint responds only after a delay (10 seconds by default).
`you+unverified@example.com`	The email is unverified: email_verified is "false" in the ID token and false in /v2/userinfo.
`you+renamed@example.com`	Same subject (sub) as the address without +renamed, but a different email, as if the user changed it.
`you+noemail@example.com`	No email or email_verified, even with the email scope, like a member who signed up with a phone number.
`you+nophoto@example.com`	No picture claim in the ID token or /v2/userinfo, like a member without a profile photo.
`you+badcode@example.com`	The authorization code exchange returns invalid_request ("Unable to retrieve access token: …").
`you+down@example.com`	The token endpoint returns 503 Service Unavailable.
`you+flaky@example.com`	The first exchange of each code returns 503; retrying with the same code succeeds.
`you+slow@example.com`	The token endpoint responds only after a delay (10 seconds by default).
`you+renamed@example.com`	Same subject (sub) as the address without +renamed, but a different email, as if the user changed it.
`you+noemail@example.com`	No confirmed_email in /2/users/me, even with the users.email scope, like an account that signed up with a phone number.
`you+revoked@example.com`	Sign-in works, but every refresh returns invalid_request, as if access was revoked. X issues a refresh token only for offline.access.
`you+badcode@example.com`	The authorization code exchange returns invalid_request ("Value passed for the authorization code was invalid.").
`you+down@example.com`	The token endpoint returns 503 Service Unavailable.
`you+flaky@example.com`	The first exchange of each code returns 503; retrying with the same code succeeds.
`you+slow@example.com`	The token endpoint responds only after a delay (10 seconds by default).
`you+renamed@example.com`	Same id as the address without +renamed, but a different email, as if the user changed it.
`you+noemail@example.com`	Declines the email permission in the dialog: /me has no email, and debug_token's scopes leave out email.
`you+nophoto@example.com`	The profile picture is a silhouette (picture.data.is_silhouette: true).
`you+badcode@example.com`	The authorization code exchange returns OAuthException code 100, "Invalid verification code format."
`you+down@example.com`	The token endpoint returns 503 Service Unavailable.
`you+flaky@example.com`	The first exchange of each code returns 503; retrying with the same code succeeds.
`you+slow@example.com`	The token endpoint responds only after a delay (10 seconds by default).

Only tags for the selected provider are listed; a provider ignores the others. Apps that strip +tags from emails will treat these addresses as one user.