By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
Note
Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.
Description
This PR fixes an issue where the refresh token request for Microsoft OAuth was failing with error AADSTS90009. Previously, the refresh payload only included the grant_type, refresh_token, client_id, and optionally client_secret.
Azure AD requires the scope (or resource) to be explicitly provided when refreshing a token. Without it, Azure interprets the request as “the application is requesting a token for itself,” which triggers the 400 error:
AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself.
Changes
Added support for including a custom scope in the refresh token request.
The scope is read from the environment variable MICROSOFT_OAUTH_SCOPE.
Example format for the scope:
openid email profile offline_access api://<Application ID URI>/<custom_scope>
Updated _perform_token_refresh to include this scope when refreshing tokens.
Root Cause
Azure AD v2.0 requires explicit scopes in refresh token requests to determine which resource the new access token should target.
Omitting scope caused Azure to treat the request as self-targeted, resulting in AADSTS90009.
Including the custom scope resolves this and allows token refreshes to succeed.
Logs Before Fix
Token refresh failed for provider microsoft: 400 - {"error":"invalid_request","error_description":"AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself."}
Logs After Fix
Refresh token requests now succeed, and new access tokens are issued without errors.
Environment Variables
MICROSOFT_OAUTH_SCOPE (required) – the custom scope for token requests.
Optional Configuration (Potential Follow-up)
As a potential follow-up improvement, it may also be possible to control this behavior via an environment variable, if maintainers consider this a suitable approach:
OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE=false # default
This would allow enabling or disabling the inclusion of the scope parameter in refresh token requests.
This approach remains compliant with RFC 6749 Section 6, where the scope parameter is optional during refresh token requests and typically omitted unless required by the OAuth provider.
This option would only need to be enabled for OAuth providers that require scope to be included in refresh token requests (such as some Azure AD configurations).
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/22359
**Author:** [@pedro-inf-custodio](https://github.com/pedro-inf-custodio)
**Created:** 3/7/2026
**Status:** ✅ Merged
**Merged:** 3/8/2026
**Merged by:** [@tjbck](https://github.com/tjbck)
**Base:** `dev` ← **Head:** `fix/add-scope-refresh-token-oauth`
---
### 📝 Commits (6)
- [`416597a`](https://github.com/open-webui/open-webui/commit/416597a9e4bf7f74a1a80096aa8a0f49ae79dbae) fix: add support for scope in OAuth refresh token request
- [`6b93e33`](https://github.com/open-webui/open-webui/commit/6b93e33de7480bdff4672426578157e763d61aff) add oauth refresh token include scope
- [`b9cca4b`](https://github.com/open-webui/open-webui/commit/b9cca4bac9bd1f2653b0d8cb60eddfa3575c762a) Fix variable import
- [`a461157`](https://github.com/open-webui/open-webui/commit/a4611570d9b065e187038cb0faf43e97cef04c7d) Fix env variables import
- [`efd7ac9`](https://github.com/open-webui/open-webui/commit/efd7ac970686f9334ac909a35601db52113ef60d) Added debug logs WIP
- [`781333e`](https://github.com/open-webui/open-webui/commit/781333e3668c68bbcaf7e1dfaa5c6b9b0e29269c) Remove debug logs
### 📊 Changes
**2 files changed** (+28 additions, -0 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/config.py` (+6 -0)
📝 `backend/open_webui/utils/oauth.py` (+22 -0)
</details>
### 📄 Description
### Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
> **Note**
>
> Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.
---
## Description
This PR fixes an issue where the refresh token request for Microsoft OAuth was failing with error `AADSTS90009`. Previously, the refresh payload only included the `grant_type`, `refresh_token`, `client_id`, and optionally `client_secret`.
Azure AD requires the **scope (or resource)** to be explicitly provided when refreshing a token. Without it, Azure interprets the request as “the application is requesting a token for itself,” which triggers the 400 error:
```
AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself.
```
### Changes
- Added support for including a **custom scope** in the refresh token request.
- The scope is read from the environment variable `MICROSOFT_OAUTH_SCOPE`.
- Example format for the scope:
```
openid email profile offline_access api://<Application ID URI>/<custom_scope>
```
- Updated `_perform_token_refresh` to include this scope when refreshing tokens.
### Root Cause
- Azure AD v2.0 requires **explicit scopes** in refresh token requests to determine which resource the new access token should target.
- Omitting `scope` caused Azure to treat the request as self-targeted, resulting in `AADSTS90009`.
- Including the custom scope resolves this and allows token refreshes to succeed.
### Logs Before Fix
```
Token refresh failed for provider microsoft: 400 - {"error":"invalid_request","error_description":"AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself."}
```
### Logs After Fix
- Refresh token requests now succeed, and new access tokens are issued without errors.
### Environment Variables
- `MICROSOFT_OAUTH_SCOPE` (required) – the custom scope for token requests.
### Optional Configuration (Potential Follow-up)
As a potential follow-up improvement, it may also be possible to control this behavior via an environment variable, if maintainers consider this a suitable approach:
`OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE=false # default`
This would allow enabling or disabling the inclusion of the `scope` parameter in refresh token requests.
This approach remains compliant with **RFC 6749 Section 6**, where the `scope` parameter is optional during refresh token requests and typically omitted unless required by the OAuth provider.
> This option would only need to be enabled for OAuth providers that require `scope` to be included in refresh token requests (such as some Azure AD configurations).
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/22359
Author: @pedro-inf-custodio
Created: 3/7/2026
Status: ✅ Merged
Merged: 3/8/2026
Merged by: @tjbck
Base:
dev← Head:fix/add-scope-refresh-token-oauth📝 Commits (6)
416597afix: add support for scope in OAuth refresh token request6b93e33add oauth refresh token include scopeb9cca4bFix variable importa461157Fix env variables importefd7ac9Added debug logs WIP781333eRemove debug logs📊 Changes
2 files changed (+28 additions, -0 deletions)
View changed files
📝
backend/open_webui/config.py(+6 -0)📝
backend/open_webui/utils/oauth.py(+22 -0)📄 Description
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
Description
This PR fixes an issue where the refresh token request for Microsoft OAuth was failing with error
AADSTS90009. Previously, the refresh payload only included thegrant_type,refresh_token,client_id, and optionallyclient_secret.Azure AD requires the scope (or resource) to be explicitly provided when refreshing a token. Without it, Azure interprets the request as “the application is requesting a token for itself,” which triggers the 400 error:
Changes
MICROSOFT_OAUTH_SCOPE._perform_token_refreshto include this scope when refreshing tokens.Root Cause
scopecaused Azure to treat the request as self-targeted, resulting inAADSTS90009.Logs Before Fix
Logs After Fix
Environment Variables
MICROSOFT_OAUTH_SCOPE(required) – the custom scope for token requests.Optional Configuration (Potential Follow-up)
As a potential follow-up improvement, it may also be possible to control this behavior via an environment variable, if maintainers consider this a suitable approach:
OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE=false # defaultThis would allow enabling or disabling the inclusion of the
scopeparameter in refresh token requests.This approach remains compliant with RFC 6749 Section 6, where the
scopeparameter is optional during refresh token requests and typically omitted unless required by the OAuth provider.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.