Drupal OAuth/OpenID
Connect Server

OAuth Server Integration Features

Authorization Code Grant

Enables a secure, two-step OAuth 2.0 flow where users authenticate and receive an authorization code, which is then exchanged for an access token. Ideal for web applications.

OIDC Support

Adds OpenID Connect support to extend OAuth with user identity verification and ID tokens, enabling SSO and richer user profile sharing.

Support for Symmetric JWT Signing Algorithms

Sign and verify JWTs using symmetric algorithms like HS256, HS384, and HS512 with a shared secret, suitable for trusted internal integrations.

Enable/Disable Master Switch

Toggle the OAuth server functionality on or off instantly from a central setting, useful during maintenance or staging setups.

Support for Multiple OAuth/OIDC Clients

Manage multiple client applications, each with its own configuration, credentials, grant types, and redirect URIs—all from one interface.

Customized Claims in ID Token

Add custom fields from user profiles into the ID token claims to share additional information with connected clients.

Multiple Callback URLs

Register and manage multiple redirect URIs per client for different environments (e.g., dev, staging, prod) or app modules.

Support for Implicit, Password, Client Credentials, Refresh Token, and PKCE

You can create and use your own security certificates to sign or encrypt the SSO data instead of using the default ones. This helps meet specific security policies of your organization or clients.

Customize Token Expiry

Define how long access tokens remain valid to balance security with user experience, configurable per client.

Customize Callback URL Validation

Control how strictly redirect URIs are validated during authorization to support both static and dynamic apps.

Enforce State Parameter

Enable strict usage of the state parameter to prevent CSRF attacks and maintain request integrity across redirects.

Consent Screen

Display a consent screen during login to show users what data will be shared with the client app.

Support for Headless Integration

Enable OAuth authentication in headless or decoupled frontend applications where no UI interaction is involved.

Customize Response Attributes

Map complex or custom user fields to be included in token responses or sent as claims, tailored for app-specific needs.