open-webui/open-webui · error · HTTPException

OAuth client registration is still invalid after re-registra

Error message

OAuth client registration is still invalid after re-registration

What it means

Final 500 in the authorize endpoint's self-healing chain: the client record was refetched successfully after re-registration, but _preflight_authorization_url(client, client_info) still fails — the reconstructed authorization URL remains invalid. Re-registration reproduced the same broken registration, so the repair loop gives up.

Source

Thrown at backend/open_webui/main.py:2624

        )

        registered = await register_client(request, client_id)
        if not registered:
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail='Failed to re-register OAuth client',
            )

        client = await oauth_client_manager.get_client(client_id)
        client_info = await oauth_client_manager.get_client_info(client_id)
        if client is None or client_info is None:
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail='OAuth client unavailable after re-registration',
            )

        if not await oauth_client_manager._preflight_authorization_url(client, client_info):
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail='OAuth client registration is still invalid after re-registration',
            )

    return await oauth_client_manager.handle_authorize(request, client_id=client_id)


@app.get('/oauth/clients/{client_id}/callback')
async def oauth_client_callback(
    client_id: str,
    request: Request,
    response: Response,
    user=Depends(get_verified_user),
):
    return await oauth_client_manager.handle_callback(
        request,
        client_id=client_id,
        user_id=user.id if user else None,

View on GitHub (pinned to 01f4282f1f)

Solutions

1. Verify the instance's public URL configuration (WEBUI_URL / proxy headers) — the authorization URL is built from it and must match the IdP's registered redirect URI exactly, including scheme and port.
2. Compare the provider's advertised authorization_endpoint (.well-known/openid-configuration) with what the preflight builds; fix issuer/discovery config if they diverge.
3. If the provider requires pre-registered static redirect URIs, register them out-of-band instead of relying on DCR.
4. Capture the exact URL preflight rejects (add temporary logging around _preflight_authorization_url) and correct the component that is wrong.

const authUrl = buildAuthorizationUrl(client, clientInfo);
const expectedOrigin = new URL(WEBUI_URL).origin;
if (new URL(authUrl.redirect_uri).origin !== expectedOrigin) throw new Error('redirect URI origin mismatch — fix WEBUI_URL/proxy headers');

try { await authorize(id) } catch (e) { if (e.status === 500 && /still invalid/.test(e.detail)) { haltAutoRepair(); surfaceConfigError(); } else throw e; }

When it happens

Trigger: Systemic misconfiguration that re-registration cannot fix: wrong issuer/authorization endpoint discovered from the provider metadata, redirect URI mismatch that DCR does not validate, or a public URL (WEBUI_URL/domain) configured incorrectly so generated authorization URLs are malformed.

Common situations: Open WebUI deployed behind a proxy with wrong X-Forwarded-* headers or WEBUI_URL set to an internal hostname; provider metadata endpoint returning a private/wrong issuer; scheme mismatch (http vs https) between redirect URI and provider requirement.

Related errors

• Failed to re-register OAuth client
• OAuth client unavailable after re-registration
• Internal Server Error
• Not Found
• Audio conversion failed. Chat completions API requires mp3 o

AI-assisted analysis of open-webui/open-webui@01f4282f1f (2026-08-14). Data as JSON: /api/errors/1ed5f6d37f82d059. Report an issue: GitHub.