c512126 fix: add support for scope in OAuth refresh token request
📊 Changes
1 file changed (+12 additions, -0 deletions)
View changed files
📝backend/open_webui/utils/oauth.py (+12 -0)
📄 Description
Description
This PR fixes an issue where the refresh token request for Microsoft OAuth was failing with error AADSTS90009. Previously, the refresh payload only included the grant_type, refresh_token, client_id, and optionally client_secret.
Azure AD requires the scope (or resource) to be explicitly provided when refreshing a token. Without it, Azure interprets the request as “the application is requesting a token for itself,” which triggers the 400 error:
AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself.
Changes
Added support for including a custom scope in the refresh token request.
The scope is read from the environment variable MICROSOFT_OAUTH_SCOPE.
Example format for the scope:
openid email profile offline_access api://<Application ID URI>/<custom_scope>
Updated _perform_token_refresh to include this scope when refreshing tokens.
Root Cause
Azure AD v2.0 requires explicit scopes in refresh token requests to determine which resource the new access token should target.
Omitting scope caused Azure to treat the request as self-targeted, resulting in AADSTS90009.
Including the custom scope resolves this and allows token refreshes to succeed.
Logs Before Fix
Token refresh failed for provider microsoft: 400 - {"error":"invalid_request","error_description":"AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself."}
Logs After Fix
Refresh token requests now succeed, and new access tokens are issued without errors.
Environment Variables
MICROSOFT_OAUTH_SCOPE (required) – the custom scope for token requests.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/22356
**Author:** [@pedro-inf-custodio](https://github.com/pedro-inf-custodio)
**Created:** 3/7/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `fix/add-scope-refresh-token-oauth`
---
### 📝 Commits (1)
- [`c512126`](https://github.com/open-webui/open-webui/commit/c51212686b95b8029f3e1a19323e9df29fe7d5b5) fix: add support for scope in OAuth refresh token request
### 📊 Changes
**1 file changed** (+12 additions, -0 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/utils/oauth.py` (+12 -0)
</details>
### 📄 Description
## Description
This PR fixes an issue where the refresh token request for Microsoft OAuth was failing with error `AADSTS90009`. Previously, the refresh payload only included the `grant_type`, `refresh_token`, `client_id`, and optionally `client_secret`.
Azure AD requires the **scope (or resource)** to be explicitly provided when refreshing a token. Without it, Azure interprets the request as “the application is requesting a token for itself,” which triggers the 400 error:
```
AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself.
```
### Changes
- Added support for including a **custom scope** in the refresh token request.
- The scope is read from the environment variable `MICROSOFT_OAUTH_SCOPE`.
- Example format for the scope:
```
openid email profile offline_access api://<Application ID URI>/<custom_scope>
```
- Updated `_perform_token_refresh` to include this scope when refreshing tokens.
### Root Cause
- Azure AD v2.0 requires **explicit scopes** in refresh token requests to determine which resource the new access token should target.
- Omitting `scope` caused Azure to treat the request as self-targeted, resulting in `AADSTS90009`.
- Including the custom scope resolves this and allows token refreshes to succeed.
### Logs Before Fix
```
Token refresh failed for provider microsoft: 400 - {"error":"invalid_request","error_description":"AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself."}
```
### Logs After Fix
- Refresh token requests now succeed, and new access tokens are issued without errors.
### Environment Variables
- `MICROSOFT_OAUTH_SCOPE` (required) – the custom scope for token requests.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/22356
Author: @pedro-inf-custodio
Created: 3/7/2026
Status: ❌ Closed
Base:
main← Head:fix/add-scope-refresh-token-oauth📝 Commits (1)
c512126fix: add support for scope in OAuth refresh token request📊 Changes
1 file changed (+12 additions, -0 deletions)
View changed files
📝
backend/open_webui/utils/oauth.py(+12 -0)📄 Description
Description
This PR fixes an issue where the refresh token request for Microsoft OAuth was failing with error
AADSTS90009. Previously, the refresh payload only included thegrant_type,refresh_token,client_id, and optionallyclient_secret.Azure AD requires the scope (or resource) to be explicitly provided when refreshing a token. Without it, Azure interprets the request as “the application is requesting a token for itself,” which triggers the 400 error:
Changes
MICROSOFT_OAUTH_SCOPE._perform_token_refreshto include this scope when refreshing tokens.Root Cause
scopecaused Azure to treat the request as self-targeted, resulting inAADSTS90009.Logs Before Fix
Logs After Fix
Environment Variables
MICROSOFT_OAUTH_SCOPE(required) – the custom scope for token requests.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.