The sign-in service used by the Google Drive and OneDrive add-ons for Kodi.
A TV can't easily show a Google or Microsoft sign-in page, and the add-ons can't keep an OAuth client secret private. This small web service does both jobs: it lets you sign in from your phone or computer with a short code shown in Kodi, and it adds the client secret when the add-on refreshes its tokens.
The public instance runs at https://drive-login.herokuapp.com. You can also host your own and point the add-ons at it.
Its successor, signin-server, runs on Cloudflare Workers at https://signinserver.com with the same protocol. This instance keeps serving add-on versions that still point at it.
- In Kodi, the add-on asks the service for a short code (
POST /pin) and shows it on screen together with the service address and a QR code. - On a phone or computer on the same network as Kodi, you open the service and enter the code. The service checks that the request comes from the same public IP address as the Kodi device, then sends you to Google or Microsoft to sign in.
- The provider sends you back to the service (
/callback) with an authorization code. The service exchanges it for tokens, using the client secret and PKCE, and keeps them in memory until Kodi collects them, at most 3 minutes. - Kodi polls the service (
GET /pin/{code}) with a random secret only it knows, receives the tokens and stores them on the device. - About once an hour, the add-on refreshes its access token through the service (
POST /refresh), which adds the client secret and forwards the request to the provider.
File contents never go through this service: Kodi talks to Google and Microsoft directly. The service keeps no database and doesn't write or log tokens.
See SETUP.md for creating the Google and Microsoft OAuth apps, configuration, running it locally, deploying it, and pointing the Kodi add-ons at your server.
Requires Java 25. The Maven wrapper downloads everything else.
./mvnw test
./mvnw packageThe tests run the whole sign-in over real HTTP for both providers (code, redirect to the provider, callback, token pickup, refresh) against a mock token endpoint, plus the pages, error messages, rate limits, HTTPS redirect and security headers. No real Google or Microsoft credentials are needed.
The add-ons and the sign-in service are free and open source, and run by one developer for everyone using Google Drive, OneDrive and Dropbox in Kodi. Keeping the service online, and the add-ons working as the services change, takes time and money. If you find them useful, you can support the project on Ko-fi.
Copyright (C) 2017-2026 Carlos Guzman (cguZZman).
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. See LICENSE.
If you run a modified version of this service for others, the license requires you to offer them its source code.