PluginMetadataOAuth

PluginMetadataOAuth fields

clientIdstring

OAuth2 client ID

clientSecretstring

OAuth2 client secret. Only included when the caller explicitly requests expand=oauth.clientSecret and only for DIRECT plugins. Never exposed for BACKEND_PROXY or STATE_MANAGED. Used by the website to complete direct PKCE token exchanges client-side.

authorizeUrlstring

OAuth2 authorization URL

tokenUrlstring

OAuth2 token URL

scopestring

OAuth2 scope

requiresCodeVerifierboolean

Whether PKCE code verifier is required

additionalAuthorizeParamsobject

Additional query parameters that the website appends to the OAuth2 authorization URL when redirecting the user to the provider's consent screen (e.g., access_type=offline, prompt=consent).

Show children

oauthVariantstring

OAuth flow variant. DIRECT performs the PKCE token exchange client-side. BACKEND_PROXY sends the authorization code to the backend exchange. STATE_MANAGED uses POST /plugin-oauth-authorizations followed by POST /plugin-oauth-authorization-completions. The server owns state, provider configuration and credential installation; the client never exchanges tokens or supplies client credentials. This variant is advertised only when the configured state-managed host flow is ready.

Allowed values: DIRECT, BACKEND_PROXY, STATE_MANAGED.