feat: Allow Passing OAuth Token to Tool Calls #6312

New Issue

2025-11-11T16:50:42-06:00

GiteaMirror commented

2025-11-11 16:50:42 -06:00

Originally created by @koflerm on GitHub (Sep 3, 2025).

Originally assigned to: @tjbck on GitHub.

Check Existing Issues

I have searched the existing issues and discussions.

Problem Description

We want to pass the identity, to be concrete the oauth token returned via the SSO login, to the tool calls. This is required as we query information from our data sources via the tools and would like to ensure the user only gets information returned which he/she is allowed to see.

Desired Solution you'd like

The desired solution would be to have the oauth token available in the tool code in order to pass this token as part of the requests to external systems, which can then use the token to verify the user identity.

Alternatives Considered

I did not find any alternative solutions how this would work so far. Appreciated if anybody knows a solution how to handle this.

Additional Context

No response

Originally created by @koflerm on GitHub (Sep 3, 2025). Originally assigned to: @tjbck on GitHub. ### Check Existing Issues - [x] I have searched the existing issues and discussions. ### Problem Description We want to pass the identity, to be concrete the oauth token returned via the SSO login, to the tool calls. This is required as we query information from our data sources via the tools and would like to ensure the user only gets information returned which he/she is allowed to see. ### Desired Solution you'd like The desired solution would be to have the oauth token available in the tool code in order to pass this token as part of the requests to external systems, which can then use the token to verify the user identity. ### Alternatives Considered I did not find any alternative solutions how this would work so far. Appreciated if anybody knows a solution how to handle this. ### Additional Context _No response_

GiteaMirror closed this issue

2025-11-11 16:50:42 -06:00

GiteaMirror commented

2025-11-11 16:50:43 -06:00

@tjbck commented on GitHub (Sep 3, 2025):

Related: https://github.com/open-webui/open-webui/discussions/8957 https://github.com/open-webui/open-webui/issues/17178

@tjbck commented on GitHub (Sep 3, 2025): Related: https://github.com/open-webui/open-webui/discussions/8957 https://github.com/open-webui/open-webui/issues/17178

GiteaMirror commented

2025-11-11 16:50:43 -06:00

@jrkropp commented on GitHub (Sep 4, 2025):

This is how I got around the refresh token issue. https://github.com/jrkropp/open-webui-developer-toolkit/tree/development/tools/microsoft_365_tool

@jrkropp commented on GitHub (Sep 4, 2025): This is how I got around the refresh token issue. https://github.com/jrkropp/open-webui-developer-toolkit/tree/development/tools/microsoft_365_tool

GiteaMirror commented

2025-11-11 16:50:44 -06:00

@koflerm commented on GitHub (Sep 4, 2025):

Great I did not know you can inject the __request__ parameter in the tool methods. With that I was able now to extract the OAuth token from the cookies using this code:

def print_oauth_token(
        self, __request__: dict = {}
    ) -> str:
        """
        Print OAuth token in pod log
        """

        oauth_token = __request__.cookies["oauth_id_token"]

        print("OAUTH TOKEN: " + oauth_token)
        result = ""

        return result

Thanks @jrkropp for the reference to your code!

I think it would be great to add this information to the documentation, so that __request__ can be injected. I can add a pull request to do this if you guys agree this makes sense.

@koflerm commented on GitHub (Sep 4, 2025): Great I did not know you can inject the `__request__` parameter in the tool methods. With that I was able now to extract the OAuth token from the cookies using this code: ``` def print_oauth_token( self, __request__: dict = {} ) -> str: """ Print OAuth token in pod log """ oauth_token = __request__.cookies["oauth_id_token"] print("OAUTH TOKEN: " + oauth_token) result = "" return result ``` Thanks @jrkropp for the reference to your code! I think it would be great to add this information to the documentation, so that `__request__` can be injected. I can add a pull request to do this if you guys agree this makes sense.

GiteaMirror commented

2025-11-11 16:50:44 -06:00

@tjbck commented on GitHub (Sep 4, 2025):

We might deprecate the cookie option due to https://github.com/open-webui/open-webui/issues/17178

@tjbck commented on GitHub (Sep 4, 2025): We might deprecate the cookie option due to https://github.com/open-webui/open-webui/issues/17178

GiteaMirror commented

2025-11-11 16:50:44 -06:00

@jrkropp commented on GitHub (Sep 4, 2025):

We might deprecate the cookie option due to #17178
Got it. Good to know.

@jrkropp commented on GitHub (Sep 4, 2025): > We might deprecate the cookie option due to [#17178](https://github.com/open-webui/open-webui/issues/17178) Got it. Good to know.

GiteaMirror commented

2025-11-11 16:50:44 -06:00

@koflerm commented on GitHub (Sep 5, 2025):

@tjbck Just checked #17210 and if this feature request is added, that should definitely solve my problem even better then using the cookies. Looking forward to it!

@koflerm commented on GitHub (Sep 5, 2025): @tjbck Just checked #17210 and if this feature request is added, that should definitely solve my problem even better then using the cookies. Looking forward to it!

GiteaMirror commented

2025-11-11 16:50:44 -06:00