OAuth integration tests often focus on the visible success path: open the provider, approve access, follow the callback, and assert that a user was created. That test is useful, but it can hide a more important question: which identity was allowed to give consent, and where can its token travel?

An OAuth test fixture should be treated as a small security boundary. It may use a free disposable email or a temporary email address, but it still represents a principal in your system. If the fixture is shared, long-lived, or granted production-like permissions, a convenient test can become an account takeover path.

The hidden trust boundary in OAuth tests

There are usually three identities in an OAuth test:

The application under test.

The identity-provider account that approves consent.

The local or CI runner holding the authorization code and tokens.

Teams often secure the first identity and overlook the other two.…