OAuth2 server_

Your Appwrite project can act as an OAuth 2.1 and OpenID Connect provider (OIDC provider). When you enable the OAuth2 server, third-party apps register as clients, send your users to a consent screen you host, and receive tokens your project issues. Your project becomes an identity provider that any standards-compliant OAuth or OIDC library can integrate with: the same way apps offer "Sign in with Google" or "Sign in with GitHub", integrators can offer Sign in with your product.

How it works

The OAuth2 server has four components.

1. The authorization server. Enabling the server on your project exposes the full set of endpoints: discovery, JWKS, authorize, approve and reject, token, userinfo, introspect, logout, and revoke. For more advanced integrations, device authorization, pushed authorization, and dynamic client registration are also available.
2. Clients. Each third-party app registers as a client, either confidential (it has a backend that can hold a secret) or public (a browser or mobile app that cannot). A client declares the redirect URIs it can return to and the post-logout redirect URIs it can end sessions at, chooses whether the device flow is available (off by default), and carries what your consent screen shows for it: a name, logo, tagline, and description, along with marketplace details like tags, images, and contact and privacy information.
3. The consent screen. You host a consent screen at an authorization URL you configure. When a user authorizes a client, Appwrite redirects the user to your screen, your screen confirms the grant, and Appwrite issues an authorization code the client exchanges for tokens.
4. Your APIs. The resource servers that clients call with the issued access tokens. They verify each token against your project's public keys and check the granted scopes before serving a request.

The flow follows the OAuth 2.1 authorization code grant, including PKCE for public clients, plus the OpenID Connect layer for identity. Because the server is spec-compliant, integrators can point any OAuth or OIDC client library at your project's discovery URL and it works without Appwrite-specific code. The URL is the same for every project, with only the project ID changing:

https://<REGION>.cloud.appwrite.io/v1/oauth2/<PROJECT_ID>/.well-known/openid-configuration

Standards support

The server follows the OAuth 2.1 security practices: the password and implicit access-token grants are not supported, refresh tokens rotate on every use with reuse detection, and redirect URIs match exactly. The implemented standards:

Concepts

Guides