OAuth connect setup_

Register an OAuth app

1. Open your organization in the Appwrite Console
2. Go to Settings > OAuth apps
3. Create an app with your platform name and redirect URIs
4. Copy the client ID and client secret to your server environment

Redirect URIs must match exactly what your backend uses to receive the authorization code.

Authorization flow

1. Send the user to Appwrite's authorize URL with client_id, redirect_uri, response_type=code, and scope
2. User signs in and approves the requested scopes
3. Appwrite redirects back with an authorization code
4. Your server exchanges the code for tokens using the token endpoint and your client secret
5. Store refresh tokens securely and use access tokens for Console API calls

Call the API with a user token

After the token exchange, set the access token as a bearer token. Pass the organization the user selected, the same way a Partners key does.

Refresh access tokens before they expire using the refresh token Appwrite returned during exchange.

Production checklist

• Use HTTPS redirect URIs only
• Validate state to prevent CSRF
• Store client secret and refresh tokens in a secrets manager
• Request the minimum scopes from OAuth scopes
• Handle revocation when users disconnect your integration