From 21f770fb731ff24245bc9ca8c3c82bb4171e24cf Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Wed, 21 Oct 2026 09:38:34 +0200 Subject: [PATCH] fix: OAuth 2.1 (Static) MCP connections send no client secret to servers like X Ads (#32818) With OAuth 2.1 (Static), when the authorization server did not accept the client secret as a form field, Open WebUI used whichever auth method the server's metadata listed first. X Ads lists "none" (public client, no secret) first, so the token exchange went out without the configured client secret and X rejected it with "Missing valid authorization header". When the server supports HTTP Basic auth, the secret is now sent that way, no matter which method it lists first. Fixes #32813 --- backend/open_webui/utils/oauth.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py index ee690088b6..7ab365828e 100644 --- a/backend/open_webui/utils/oauth.py +++ b/backend/open_webui/utils/oauth.py @@ -714,7 +714,11 @@ async def get_oauth_client_info_with_static_credentials( oauth_server_metadata.token_endpoint_auth_methods_supported and token_endpoint_auth_method not in oauth_server_metadata.token_endpoint_auth_methods_supported ): - token_endpoint_auth_method = oauth_server_metadata.token_endpoint_auth_methods_supported[0] + # List order is no preference; prefer a method that sends the secret + if 'client_secret_basic' in oauth_server_metadata.token_endpoint_auth_methods_supported: + token_endpoint_auth_method = 'client_secret_basic' + else: + token_endpoint_auth_method = oauth_server_metadata.token_endpoint_auth_methods_supported[0] oauth_client_info = OAuthClientInformationFull( client_id=oauth_client_id,