OAuth providers_

OAuth2 providers let your users sign in with accounts they already have, such as GitHub, Google, or Apple. Each provider stores a client ID and client secret at the project level, and can be enabled or disabled independently.

You can configure providers from the Appwrite Console or programmatically with a Server SDK. Each provider has its own update method (updateOAuth2GitHub, updateOAuth2Google, and so on), the read methods listOAuth2Providers and getOAuth2Provider cover all of them.

Configure from the Console

To configure a provider from the Console:

1. Open your project in the Appwrite Console.
2. Navigate to Auth in the sidebar, then open the Settings tab.
3. Find the provider in the OAuth2 Providers list and click it.
4. Enter the credentials from the provider (the field names vary per provider, see Available providers).
5. Toggle the provider on and click Update.

Configure a provider

Each provider has a dedicated update method named updateOAuth2<Provider>. The example below configures GitHub. Swap the method name and credential fields to configure a different provider, the field names per provider are listed in Available providers.

Providers with extra fields

Some providers take more than a client ID and secret. Google, for example, accepts an additional prompt parameter that controls the consent screen behavior:

Available providers

Every provider has its own updateOAuth2<Provider> method. The credential field names differ per provider, use the columns below to map the provider's credentials to the method's parameters.

List providers

List every OAuth2 provider and its current configuration state.

Get a provider

Fetch a single provider's configuration by its provider ID.

Benefits

• Repeatable provisioning. Script the full set of OAuth2 providers a project needs and recreate it on demand, without clicking through the Console.
• Environment parity. Keep dev, staging, and production projects in sync by running the same configuration script against each one.
• Server-only secrets. Client secrets are write-only over the API and never returned in responses, so configuration scripts can run in CI without exposing them.