Sign in

All seeded members share password Password123!. Sign in to receive an OAuth2 bearer token, then send it as Authorization: Bearer <token>.

Seeded members

• shopper@market.example — attacker identity (owns order 1001 / payment 1001)
• victim@market.example — victim (owns order 1002, whose note holds the IDOR canary)
• merchant@market.example — noise
• admin@market.example — noise