Skip to content

feat(openapi): add OAuth 2.1 server endpoints and clarify OAuth modes #2165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 6 commits into from
Sep 22, 2025
Merged

feat(openapi): add OAuth 2.1 server endpoints and clarify OAuth modes #2165

merged 6 commits into from
Sep 22, 2025

Conversation

cemalkilic
Copy link
Contributor

Summary

  • Add OAuth server endpoints to openapi doc:

    • POST /oauth/clients/register - dynamic client registration
    • POST /oauth/token - token endpoint
    • GET /oauth/authorize - authorization endpoint
    • GET /oauth/authorizations/{id} - get authorization details
    • POST /oauth/authorizations/{id}/consent - approve/deny authorization
    • Admin endpoints: /admin/oauth/clients/* for client management

  • Clarify OAuth documentation with two distinct modes:

    • oauth-client: Auth service as OAuth client (external providers)
    • oauth-server: Auth service as OAuth provider (for other apps)

  • Add OAuthClientSchema for consistent client object structure

  • Document configuration requirements (GOTRUE_OAUTH_SERVER_ENABLED, GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION)

@cemalkilic cemalkilic requested a review from a team as a code owner September 14, 2025 13:35
hf
hf reviewed Sep 18, 2025
View reviewed changes
@cemalkilic cemalkilic merged commit 1f804a2 into master Sep 22, 2025
5 checks passed
@cemalkilic cemalkilic deleted the cemal/feat-update-openapi branch September 22, 2025 21:09
@github-actions github-actions bot mentioned this pull request Sep 22, 2025
Merged
@coveralls
Copy link

Pull Request Test Coverage Report for Build 17928574595

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

Details

  • 1 of 1 (100.0%) changed or added relevant line in 1 file are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage increased (+0.002%) to 67.884%
Totals Coverage Status
Change from base Build 17928296836: 0.002%
Covered Lines: 12955
Relevant Lines: 19084
💛 - Coveralls

cemalkilic pushed a commit that referenced this pull request Sep 23, 2025
@github-actions
chore(master): release 2.180.0 (#2151)
3511eb4 
🤖 I have created a release *beep* *boop*
---


##
[2.180.0](v2.179.0...v2.180.0)
(2025-09-23)


### Features

* add OAuth client type
([#2152](#2152))
([b118f1f](b118f1f))
* add phone to sms webhook payload
([#2160](#2160))
([d475ac1](d475ac1))
* background template reloading p1 - baseline decomposition
([#2148](#2148))
([746c937](746c937))
* config reloading with fsnotify, poller fallback, and signals
([#2161](#2161))
([c77d512](c77d512))
* enhance issuer URL validation in OAuth server metadata
([#2164](#2164))
([a9424d2](a9424d2))
* implement OAuth2 authorization endpoint
([#2107](#2107))
([5318552](5318552))
* **oauth2:** add `/oauth/token` endpoint
([#2159](#2159))
([a89a0b0](a89a0b0))
* **oauth2:** add admin endpoint to regenerate OAuth client secrets
([#2170](#2170))
([0bd1c28](0bd1c28))
* **oauth2:** return redirect_uri on GET authorization
([#2175](#2175))
([b0a0c3e](b0a0c3e))
* **oauth2:** use `id` field as the public client_id
([#2154](#2154))
([86b7de4](86b7de4))
* **openapi:** add OAuth 2.1 server endpoints and clarify OAuth modes
([#2165](#2165))
([1f804a2](1f804a2))
* password changed email notification
([#2176](#2176))
([fe0fd04](fe0fd04))
* support `transfer_sub` in apple id tokens
([#2162](#2162))
([8a71006](8a71006))


### Bug Fixes

* ensure request context exists in API db operations
([#2171](#2171))
([060a992](060a992))
* **makefile:** remove invalid @ symbol from shell commands
([#2168](#2168))
([e6afe45](e6afe45))
* **oauth2:** switch to Origin header for request validation
([#2174](#2174))
([42bc9ab](42bc9ab))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
issuedat pushed a commit that referenced this pull request Sep 30, 2025
@cemalkilic @issuedat
feat(openapi): add OAuth 2.1 server endpoints and clarify OAuth modes (…
7dd670b 
…#2165)

## Summary
- Add OAuth server endpoints to openapi doc:
  - POST /oauth/clients/register - dynamic client registration
  - POST /oauth/token - token endpoint
  - GET /oauth/authorize - authorization endpoint
  - GET /oauth/authorizations/{id} - get authorization details
  - POST /oauth/authorizations/{id}/consent - approve/deny authorization
  - Admin endpoints: /admin/oauth/clients/* for client management

- Clarify OAuth documentation with two distinct modes:
  - oauth-client: Auth service as OAuth client (external providers)
  - oauth-server: Auth service as OAuth provider (for other apps)

- Add OAuthClientSchema for consistent client object structure
- Document configuration requirements (`GOTRUE_OAUTH_SERVER_ENABLED`,
`GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION`)
issuedat pushed a commit that referenced this pull request Sep 30, 2025
@github-actions @issuedat
chore(master): release 2.180.0 (#2151)
8d191ff 
🤖 I have created a release *beep* *boop*
---


##
[2.180.0](v2.179.0...v2.180.0)
(2025-09-23)


### Features

* add OAuth client type
([#2152](#2152))
([b118f1f](b118f1f))
* add phone to sms webhook payload
([#2160](#2160))
([d475ac1](d475ac1))
* background template reloading p1 - baseline decomposition
([#2148](#2148))
([746c937](746c937))
* config reloading with fsnotify, poller fallback, and signals
([#2161](#2161))
([c77d512](c77d512))
* enhance issuer URL validation in OAuth server metadata
([#2164](#2164))
([a9424d2](a9424d2))
* implement OAuth2 authorization endpoint
([#2107](#2107))
([5318552](5318552))
* **oauth2:** add `/oauth/token` endpoint
([#2159](#2159))
([a89a0b0](a89a0b0))
* **oauth2:** add admin endpoint to regenerate OAuth client secrets
([#2170](#2170))
([0bd1c28](0bd1c28))
* **oauth2:** return redirect_uri on GET authorization
([#2175](#2175))
([b0a0c3e](b0a0c3e))
* **oauth2:** use `id` field as the public client_id
([#2154](#2154))
([86b7de4](86b7de4))
* **openapi:** add OAuth 2.1 server endpoints and clarify OAuth modes
([#2165](#2165))
([1f804a2](1f804a2))
* password changed email notification
([#2176](#2176))
([fe0fd04](fe0fd04))
* support `transfer_sub` in apple id tokens
([#2162](#2162))
([8a71006](8a71006))


### Bug Fixes

* ensure request context exists in API db operations
([#2171](#2171))
([060a992](060a992))
* **makefile:** remove invalid @ symbol from shell commands
([#2168](#2168))
([e6afe45](e6afe45))
* **oauth2:** switch to Origin header for request validation
([#2174](#2174))
([42bc9ab](42bc9ab))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@cemalkilic cemalkilic mentioned this pull request Oct 2, 2025
Merged
@grdsdev grdsdev mentioned this pull request Oct 2, 2025
Open
4 tasks
mandarini pushed a commit to supabase/supabase-js that referenced this pull request Oct 3, 2025
@cemalkilic
feat(auth): add OAuth 2.1 client admin endpoints (#1582)
5b2f8c7 
## Summary
Adds OAuth 2.1 client administration endpoints to `@supabase/auth-js`
based on the OpenAPI specification from
supabase/auth#2165.

This PR implements a new `admin.oauth` namespace with full CRUD
operations for managing OAuth clients when the OAuth 2.1 server is
enabled in Supabase Auth

New admin.oauth methods:
- listClients() - List OAuth clients with pagination (for now, the same
api with `listUsers`)
  - createClient() - Register new OAuth client
  - getClient() - Get client details by ID
  - deleteClient() - Remove OAuth client
  - regenerateClientSecret() - Regenerate client secret

All methods include proper error handling, follow existing patterns
(similar to admin.mfa), and are only relevant when the OAuth 2.1 server
is enabled in Supabase Auth.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hf hf hf approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@cemalkilic @coveralls @hf