How to use to perform load test for OAuth2 flows – Part 1

[]( is a free load testing service that allows you to load test

How to use to test performance for OAuth2

Phan Binh Minh (PBM), senior QA of the Safewhere team, knows a thing or two about doing load testing which she wrote about in this post. is a free load testing service that allows you to load test your web-apps and apis with huge amount of concurrent connections.

Beside web-interface, also supports API to register and verify testing domains, create and run tests, view summary result data, and access a list of IP addresses that loader might send requests to your app from during a test.

With very simple steps, I can easily setup, run a test and view the test result:

  1. Add your target host: use the web-interface or API to register your app for testing
  2. Run a test
  3. Watch the test in real-time

This post will walk you through how to use to test performance for OAuth2 flows: refresh token flow and client credentials flow.

Set up target host

After registering a free account, I need to register a target host that will be tested by clicking [+ New Host]


Enter domain of the web application and click [Next: Verify] to make sure can reach the domain

loader-io-verify-host needs to verify that the domain belongs to us. I can do this by downloading the verification token file and uploading it to our server. Click on the [Verify] button to do verification.


If all are done correctly, will display a successful result: