I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.
Problem Description
When reviewing the open-webui options and documentation, it seems that client_id and client_secret are required for oauth/oidc to work. This entails a client_credentials flow, but in some environments using the auth code flow is preferred, particularly where a user is involved and it's not machine-to-machine communication.
Desired Solution you'd like
It would be good to have open-webui support the authorization code flow so that it's the user logging in, given that's what the auth flow is meant for originally.
Alternatives Considered
No response
Additional Context
First of all, is my assumption correct that based on the docs and current state only client credentials flow works, or has anyone been able to make an authorization code flow work with open-webui?
Second, if the answer is that it's not currently supported, any feedback on why not? Is it just a matter of someone putting the effort into adding support, or are there other technical reasons that make this contribution non-obvious?
Thanks!
Originally created by @pllopis on GitHub (Nov 4, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18924
### Check Existing Issues
- [x] I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.
### Problem Description
When reviewing the open-webui options and [documentation](https://docs.openwebui.com/features/auth/sso/#oidc), it seems that client_id and client_secret are required for oauth/oidc to work. This entails a **client_credentials** flow, but in some environments using the **auth code flow** is preferred, particularly where a user is involved and it's not machine-to-machine communication.
### Desired Solution you'd like
It would be good to have open-webui support the authorization code flow so that it's the user logging in, given that's what the auth flow is meant for originally.
### Alternatives Considered
_No response_
### Additional Context
First of all, is my assumption correct that based on the docs and current state only client credentials flow works, or has anyone been able to make an authorization code flow work with open-webui?
Second, if the answer is that it's not currently supported, any feedback on why not? Is it just a matter of someone putting the effort into adding support, or are there other technical reasons that make this contribution non-obvious?
Thanks!
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @pllopis on GitHub (Nov 4, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18924
Check Existing Issues
Problem Description
When reviewing the open-webui options and documentation, it seems that client_id and client_secret are required for oauth/oidc to work. This entails a client_credentials flow, but in some environments using the auth code flow is preferred, particularly where a user is involved and it's not machine-to-machine communication.
Desired Solution you'd like
It would be good to have open-webui support the authorization code flow so that it's the user logging in, given that's what the auth flow is meant for originally.
Alternatives Considered
No response
Additional Context
First of all, is my assumption correct that based on the docs and current state only client credentials flow works, or has anyone been able to make an authorization code flow work with open-webui?
Second, if the answer is that it's not currently supported, any feedback on why not? Is it just a matter of someone putting the effort into adding support, or are there other technical reasons that make this contribution non-obvious?
Thanks!
@tjbck commented on GitHub (Nov 4, 2025):
We'd be happy to review PRs!