From 6367a3cc406b3417d1a2eb2bfde9f1b841d43150 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Wed, 21 Oct 2026 19:13:50 +0200
Subject: [PATCH] fix: OAuth connections send no token when the user calls the
 API (#32826)

A model connection with its auth type set to OAuth only forwarded the user's sign-in token for requests coming from the browser. The same user calling the API with their bearer token or an API key sent nothing upstream, so an SSO-protected model server rejected every API call and its models could not be listed or used. These connections now fall back to the user's latest sign-in session the same way tool servers already do.

Fixes #32820
---
 backend/open_webui/utils/headers.py | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/backend/open_webui/utils/headers.py b/backend/open_webui/utils/headers.py
index 00262df0f1..09d0683c9e 100644
--- a/backend/open_webui/utils/headers.py
+++ b/backend/open_webui/utils/headers.py
@@ -19,6 +19,7 @@ from open_webui.env import (
     FORWARD_USER_INFO_HEADER_USER_ROLE,
 )
 from open_webui.models.groups import Groups
+from open_webui.utils.oauth import get_system_oauth_token
 
 log = logging.getLogger(__name__)
 
@@ -208,16 +209,7 @@ async def get_headers_and_cookies(
     elif auth_type == 'session':
         token = request.state.token.credentials
     elif auth_type == 'system_oauth':
-        oauth_token = None
-        try:
-            if request.cookies.get('oauth_session_id', None):
-                oauth_token = await request.app.state.oauth_manager.get_oauth_token(
-                    user.id,
-                    request.cookies.get('oauth_session_id', None),
-                )
-        except Exception as e:
-            log.error(f'Error getting OAuth token: {e}')
-
+        oauth_token = await get_system_oauth_token(request, user) if user else None
         if oauth_token:
             token = f'{oauth_token.get("access_token", "")}'