oauth2

Creates a typed OAuth 2.0 authorization-code flow.

Visiting OAuthFlowConfigBase.loginPath triggers a redirect to the OAuth provider. The provider returns to the callback route configured with OAuth2FlowConfig.callback, where the success handler receives the token response. This flow does not provide built-in route protection; handle post-login logic in the callback handler.

Routes installed by Route.install under the OAuth authentication layer—including the callback path and OAuthFlowConfigBase.loginPath—redirect unauthenticated requests to the OAuth provider. This is the default OAuth challenge when no authorization code is present.

Configure the callback route with OAuth2FlowConfig.callback and install the flow with Route.install or Application.install.

val googleOAuth = oauth2("google") {
    client = HttpClient()
    settings = OAuthServerSettings.OAuth2ServerSettings(
        name = "google",
        authorizeUrl = "https://accounts.google.com/o/oauth2/auth",
        accessTokenUrl = "https://oauth2.googleapis.com/token",
        clientId = "...",
        clientSecret = "...",
        requestMethod = HttpMethod.Post,
    )
    loginPath = "/login"
    callback("/callback") { token ->
        call.respondRedirect("/home")
    }
}

routing {
    install(googleOAuth)
}

Report a problem

Parameters