OAuth tests often look successful for the wrong reason. A browser reaches the callback, a code is exchanged, and the test sees a 200 response. But which test user was authenticated? Was the code issued for this run? Did the inbox message belong to the same identity, or did a stale message make the assertion pass?

Those questions matter when a team uses a temp email generator or other disposable test mailbox. The mailbox is only one part of the identity. The authorization request, browser session, callback, token exchange, and verification message must be tied together. I call that small set of relationships an identity ledger .

Why the callback needs an identity ledger

An OAuth callback is a trust boundary. It receives values from a browser redirect and turns them into an authenticated application session.…