Checklist
Summary
Streamlit’s st.login() (introduced in ≥1.42.0) simplifies OpenID Connect authentication by wiring up a ready-made OAuth2/OIDC client under the hood. However, it currently only reads a fixed set of configuration values—namely:
server_metadata_url
client_id
client_secret
redirect_uri
(optional) cookie_secret
All other request details (scopes, prompt, response type, audience, login hints, PKCE settings, etc.) are either hard-coded or not exposed to the end user. This limitation forces developers who need slight variations—such as adding custom scopes, changing the prompt mode to consent, specifying an audience, or tweaking PKCE parameters—to drop down to a lower-level library (Authlib, requests-oauthlib) and lose the convenience of st.login().
Why?
-
st.login() always injects the literal scopes "openid email profile".
-
No documented way to override or extend scopes, nor to add any other OAuth2/OIDC parameters (e.g. prompt, response_type, audience, login_hint, code_challenge_method, token_endpoint_auth_method, etc.).
-
Any attempt to pass additional values via client_kwargs, secrets, or env vars is ignored.
How?
Provide a flexible mechanism for developers to supply any standard (and future) OAuth2/OIDC parameters to st.login(), not just the core five:
- Extend the signature of st.login() to accept a well-documented set of optional keyword arguments (or a single client_kwargs: dict parameter).
- Merge any supplied parameters with sensible defaults when constructing the authorization URL and token request.
- Ensure backward compatibility by preserving the existing default values if no overrides are provided.
- Update the API reference, examples, and streamlit_app.py templates to illustrate how to customize scopes, prompts, audiences, PKCE, and other common OIDC/OAuth2 options.
This could take one or more of these forms:
New keyword arguments on st.login(), e.g.:
st.login(
server_metadata_url=…,
client_id=…,
client_secret=…,
redirect_uri=…,
# NEW: override or extend default scopes
scopes=["openid", "roles", "profile"],
# NEW: pass arbitrary OIDC query params
prompt="consent",
audience="https://api.myservice.internal",
login_hint="user@example.com",
response_type="code",
code_challenge_method="S256",
)
A catch-all client_kwargs dict that is forwarded to the underlying OAuth2/OIDC client, for instance:
st.login(
…,
client_kwargs={
"scope": "openid roles profile",
"prompt": "consent",
"audience": "https://api.myservice.internal",
"code_challenge_method": "S256",
}
)Support in secrets.toml or env vars for any of these parameters:
[streamlit]
server_metadata_url = "…"
client_id = "…"
client_secret = "…"
redirect_uri = "…"
scopes = "openid roles profile"
prompt = "consent"
audience = "https://api.myservice.internal"
code_challenge_method = "S256"
Additional Context
Use Cases
- Retrieving additional claims or roles using custom scopes (roles, groups, etc.).
- Forcing the user consent screen (prompt=consent) on every login.
- Targeting a specific resource server or audience (audience=…).
- Pre-filling hints for login (login_hint).
- Enabling or customizing PKCE (code_challenge_method="S256").
- Supporting advanced token endpoint auth methods (e.g. token_endpoint_auth_method="private_key_jwt").
- Allowing future extension as new OIDC/OAuth2 parameters emerge without breaking API.
Thank you for considering this enhancement! Happy to provide a proof-of-concept PR or further implementation details.
Checklist
Summary
Streamlit’s st.login() (introduced in ≥1.42.0) simplifies OpenID Connect authentication by wiring up a ready-made OAuth2/OIDC client under the hood. However, it currently only reads a fixed set of configuration values—namely:
All other request details (scopes, prompt, response type, audience, login hints, PKCE settings, etc.) are either hard-coded or not exposed to the end user. This limitation forces developers who need slight variations—such as adding custom scopes, changing the prompt mode to consent, specifying an audience, or tweaking PKCE parameters—to drop down to a lower-level library (Authlib, requests-oauthlib) and lose the convenience of st.login().
Why?
st.login() always injects the literal scopes "openid email profile".
No documented way to override or extend scopes, nor to add any other OAuth2/OIDC parameters (e.g. prompt, response_type, audience, login_hint, code_challenge_method, token_endpoint_auth_method, etc.).
Any attempt to pass additional values via client_kwargs, secrets, or env vars is ignored.
How?
Provide a flexible mechanism for developers to supply any standard (and future) OAuth2/OIDC parameters to st.login(), not just the core five:
This could take one or more of these forms:
New keyword arguments on st.login(), e.g.:
A catch-all client_kwargs dict that is forwarded to the underlying OAuth2/OIDC client, for instance:
Support in secrets.toml or env vars for any of these parameters:
Additional Context
Use Cases
Thank you for considering this enhancement! Happy to provide a proof-of-concept PR or further implementation details.