open-webui/open-webui · error · HTTPException

Failed to register OAuth client: {e}

Error message

Failed to register OAuth client: {e}

What it means

Admin config endpoint that registers an OAuth client (static or RFC 7591 dynamic client registration). Any exception during discovery/registration is caught, logged at debug, and re-raised as 400 with 'Failed to register OAuth client: {e}'. The detail carries the underlying exception text, so the message is the diagnosis.

Source

Thrown at backend/open_webui/routers/configs.py:206

            oauth_client_info = await get_oauth_client_info_with_static_credentials(
                request,
                oauth_client_id,
                oauth_server_url,
                oauth_client_id=form_data.client_id,
                oauth_client_secret=form_data.client_secret,
                oauth_scope=form_data.oauth_scope,
            )
        else:
            oauth_client_info = await get_oauth_client_info_with_dynamic_client_registration(
                request, oauth_client_id, oauth_server_url, oauth_scope=form_data.oauth_scope
            )
        return {
            'status': True,
            'oauth_client_info': encrypt_data(oauth_client_info.model_dump(mode='json')),
        }
    except Exception as e:
        log.debug(f'Failed to register OAuth client: {e}')
        raise HTTPException(
            status_code=400,
            detail=f'Failed to register OAuth client: {e}',
        )


############################
# ToolServers Config
############################


class ToolServerConnection(BaseModel):
    url: str
    path: str
    type: str | None = 'openapi'  # openapi, mcp
    auth_type: str | None
    headers: dict | str | None = None
    key: str | None
    config: dict | None

View on GitHub (pinned to 01f4282f1f)

Solutions

1. Read the detail text and server debug logs — the underlying exception names the real cause (DNS, TLS, 4xx from provider).
2. curl the provider's {issuer}/.well-known/openid-configuration and the registration_endpoint from the open-webui host to verify reachability and DCR support.
3. If the provider does not support dynamic registration, pre-register the client and supply the static client_id/secret instead of this endpoint.
4. Fix scheme/URL typos (trailing slashes, http on an https-only provider) and ensure the server clock/TLS trust store is correct.

Example fix

// before
oauth_server_url = 'http://sso.internal:8080';

// after
// verify discovery first, then submit
const disc = await fetch('https://sso.internal/.well-known/openid-configuration');
if (!disc.ok) throw new Error('issuer unreachable');
const { registration_endpoint } = await disc.json();
if (!registration_endpoint) { /* use static client registration */ }

// prove discovery + DCR support from the open-webui host before calling the endpoint
const disc = await fetch(`${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`);
if (!disc.ok) throw new Error('issuer discovery failed');
const { registration_endpoint } = await disc.json();
if (!registration_endpoint) throw new Error('provider has no dynamic registration — use static client');

try { await api.post('/configs/oauth/register', payload); } catch (e) { const detail = e.response?.data?.detail ?? ''; // detail embeds the provider error
 log(detail); throw new Error(detail || 'oauth registration failed'); }

When it happens

Trigger: POST to the SSO/OAuth config endpoint with an oauth_server_url that is unreachable, has a malformed issuer/discovery document, rejects the registration request, or where dynamic registration is not supported by the provider.

Common situations: Wrong issuer URL (missing/wrong path, http vs https), self-signed certificate without trust config, provider requiring an initial access token for DCR, network egress blocked from the open-webui host, or unsupported grant/scope parameters.

Related errors

• Failed to re-register OAuth client
• The requested action has been restricted as a security measu
• Not Found
• OAuth client unavailable after re-registration
• OAuth client registration is still invalid after re-registra

AI-assisted analysis of open-webui/open-webui@01f4282f1f (2026-08-14). Data as JSON: /api/errors/734d45fff6808329. Report an issue: GitHub.