This PR adds OAuth support for Tool Server authentication.
Note: This PR enables logging in through a provider configured in the backend, and getting an "access token" which can be used to validate subsequent requests. Available providers are Google and Atlassian. Feel free to extend this for the providers that are most relevant!
This PR does not implement the entire OpenWebUI -> OAuth + MCP flow discussed in #14121. I hit a few roadblocks along the way and I believe some extra refactoring work is needed to get it to work. I'll write some suggestions about how we could approach that and some clues I found.
Changelog Entry
Description
This PR enables logging in through a provider configured in the backend, and getting an "access token" which can be used to validate subsequent requests. Available providers are Google and Atlassian. This can be easily extended with any provider needed.
Added
Added OAuth authentication option for Tool Servers
Added Tool Server provider configuration variables and provider loading
Added relevant endpoints for handling OAuth login for tool servers
Extended AddServerModal to show providers and handle entire OAuth flow, including manual token refresh
Otherwise, I can post my credentials and then manually add a reviewer's email (otherwise it won't work, since it's a test auth app).
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/14786
**Author:** [@jescalada](https://github.com/jescalada)
**Created:** 6/8/2025
**Status:** ❌ Closed
**Base:** `dev` ← **Head:** `add-tool-server-oauth`
---
### 📝 Commits (10+)
- [`0f111f2`](https://github.com/open-webui/open-webui/commit/0f111f22a0ed2520a8b6588604e32b9215909ee8) enh: add TOOL_GOOGLE configs
- [`9ac03f0`](https://github.com/open-webui/open-webui/commit/9ac03f09a3d248228210a34d17d0aab75f3a0a1f) enh: add TOOL_ATLASSIAN configs
- [`3758d87`](https://github.com/open-webui/open-webui/commit/3758d8739c194b80147816fd98e7dd4d9eca50b2) enh: add TOOL_SERVER_OAUTH_PROVIDERS loader
- [`f35d5f3`](https://github.com/open-webui/open-webui/commit/f35d5f3b702ab96f01473ac4923880e2432df373) fix: extract tool server config scopes
- [`4fa41be`](https://github.com/open-webui/open-webui/commit/4fa41be3ce8336ca8b4430a725a066c44d5b8eec) feat: add ToolServerOAuthManager class and init
- [`62e554d`](https://github.com/open-webui/open-webui/commit/62e554d802bb6d3e57703e609eea9bd9453e92c5) feat: add tool server login and callback support for OAuth
- [`0264866`](https://github.com/open-webui/open-webui/commit/0264866ea72f670bcade6b5a6e96829b327cfa87) enh: import ToolServerOAuthManager to main.py
- [`263a33f`](https://github.com/open-webui/open-webui/commit/263a33fe74f465fc3f0362435c6eb88899102394) feat: add login endpoint for any OAuth provider
- [`909ca31`](https://github.com/open-webui/open-webui/commit/909ca31c5ac50c545a868c7ff7aa942c3b88e5b3) feat: add OAuth callback endpoint
- [`226d82f`](https://github.com/open-webui/open-webui/commit/226d82fdd945a9077e93c2fb51cc4bfc70d0106f) feat: add endpoint and middleware for fetching providers
### 📊 Changes
**10 files changed** (+371 additions, -20 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/config.py` (+129 -0)
📝 `backend/open_webui/main.py` (+56 -2)
📝 `backend/open_webui/routers/configs.py` (+1 -1)
📝 `backend/open_webui/utils/oauth.py` (+42 -0)
📝 `backend/open_webui/utils/tools.py` (+2 -2)
📝 `src/lib/apis/configs/index.ts` (+1 -1)
📝 `src/lib/apis/index.ts` (+9 -2)
📝 `src/lib/components/AddServerModal.svelte` (+115 -11)
📝 `src/lib/components/chat/Settings/Tools/Connection.svelte` (+14 -0)
📝 `src/routes/+layout.svelte` (+2 -1)
</details>
### 📄 Description
This PR adds OAuth support for Tool Server authentication.
**Note:** This PR enables logging in through a provider configured in the backend, and getting an "access token" which can be used to validate subsequent requests. Available providers are Google and Atlassian. Feel free to extend this for the providers that are most relevant!
This PR **does not** implement the entire OpenWebUI -> OAuth + MCP flow discussed in #14121. I hit a few roadblocks along the way and I believe some extra refactoring work is needed to get it to work. I'll write some suggestions about how we could approach that and some clues I found.
# Changelog Entry
### Description
- This PR enables logging in through a provider configured in the backend, and getting an "access token" which can be used to validate subsequent requests. Available providers are Google and Atlassian. This can be easily extended with any provider needed.
### Added
- Added OAuth authentication option for Tool Servers
- Added Tool Server provider configuration variables and provider loading
- Added relevant endpoints for handling OAuth login for tool servers
- Extended `AddServerModal` to show providers and handle entire OAuth flow, including **manual** token refresh
---
### Additional Information
- Relevant issues
- #14121
- #13457
### Screenshots or Videos
#### Demo Video
[Demo](https://github.com/user-attachments/assets/b992d959-a7d4-445e-896a-b872c896fb9f)
Note that my cursor isn't showing in the video, sorry about that!
### Testing
If you'd like to test this PR, you can create your own Google auth client here: https://console.cloud.google.com/apis/credentials
Otherwise, you can do the same with an Atlassian OAuth 2.0 app: https://developer.atlassian.com/console/myapps
Otherwise, I can post my credentials and then manually add a reviewer's email (otherwise it won't work, since it's a test auth app).
### Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/14786
Author: @jescalada
Created: 6/8/2025
Status: ❌ Closed
Base:
dev← Head:add-tool-server-oauth📝 Commits (10+)
0f111f2enh: add TOOL_GOOGLE configs9ac03f0enh: add TOOL_ATLASSIAN configs3758d87enh: add TOOL_SERVER_OAUTH_PROVIDERS loaderf35d5f3fix: extract tool server config scopes4fa41befeat: add ToolServerOAuthManager class and init62e554dfeat: add tool server login and callback support for OAuth0264866enh: import ToolServerOAuthManager to main.py263a33ffeat: add login endpoint for any OAuth provider909ca31feat: add OAuth callback endpoint226d82ffeat: add endpoint and middleware for fetching providers📊 Changes
10 files changed (+371 additions, -20 deletions)
View changed files
📝
backend/open_webui/config.py(+129 -0)📝
backend/open_webui/main.py(+56 -2)📝
backend/open_webui/routers/configs.py(+1 -1)📝
backend/open_webui/utils/oauth.py(+42 -0)📝
backend/open_webui/utils/tools.py(+2 -2)📝
src/lib/apis/configs/index.ts(+1 -1)📝
src/lib/apis/index.ts(+9 -2)📝
src/lib/components/AddServerModal.svelte(+115 -11)📝
src/lib/components/chat/Settings/Tools/Connection.svelte(+14 -0)📝
src/routes/+layout.svelte(+2 -1)📄 Description
This PR adds OAuth support for Tool Server authentication.
Note: This PR enables logging in through a provider configured in the backend, and getting an "access token" which can be used to validate subsequent requests. Available providers are Google and Atlassian. Feel free to extend this for the providers that are most relevant!
This PR does not implement the entire OpenWebUI -> OAuth + MCP flow discussed in #14121. I hit a few roadblocks along the way and I believe some extra refactoring work is needed to get it to work. I'll write some suggestions about how we could approach that and some clues I found.
Changelog Entry
Description
Added
AddServerModalto show providers and handle entire OAuth flow, including manual token refreshAdditional Information
Screenshots or Videos
Demo Video
Demo
Note that my cursor isn't showing in the video, sorry about that!
Testing
If you'd like to test this PR, you can create your own Google auth client here: https://console.cloud.google.com/apis/credentials
Otherwise, you can do the same with an Atlassian OAuth 2.0 app: https://developer.atlassian.com/console/myapps
Otherwise, I can post my credentials and then manually add a reviewer's email (otherwise it won't work, since it's a test auth app).
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.