From 69171a4c8bb7f995461b4a2feef194f112b32004 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Tue, 24 Mar 2026 05:13:31 -0500
Subject: [PATCH] refac

---
 backend/open_webui/config.py      | 12 ++++++++++++
 backend/open_webui/utils/oauth.py |  3 +++
 2 files changed, 15 insertions(+)

diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py
index 3cbeb36644..a9970647b1 100644
--- a/backend/open_webui/config.py
+++ b/backend/open_webui/config.py
@@ -642,6 +642,18 @@ OAUTH_AUDIENCE = PersistentConfig(
     os.environ.get('OAUTH_AUDIENCE', ''),
 )
 
+OAUTH_AUTHORIZE_PARAMS = {}
+_oauth_authorize_params = os.environ.get('OAUTH_AUTHORIZE_PARAMS', '')
+if _oauth_authorize_params:
+    try:
+        _parsed = json.loads(_oauth_authorize_params)
+        if isinstance(_parsed, dict):
+            OAUTH_AUTHORIZE_PARAMS = _parsed
+        else:
+            log.warning('OAUTH_AUTHORIZE_PARAMS must be a JSON object, ignoring')
+    except (json.JSONDecodeError, TypeError):
+        log.warning('OAUTH_AUTHORIZE_PARAMS is not valid JSON, ignoring')
+
 
 def load_oauth_providers():
     OAUTH_PROVIDERS.clear()
diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py
index ddf9af6294..aa5bc47df6 100644
--- a/backend/open_webui/utils/oauth.py
+++ b/backend/open_webui/utils/oauth.py
@@ -60,6 +60,7 @@ from open_webui.config import (
     OAUTH_UPDATE_EMAIL_ON_LOGIN,
     OAUTH_ACCESS_TOKEN_REQUEST_INCLUDE_CLIENT_ID,
     OAUTH_AUDIENCE,
+    OAUTH_AUTHORIZE_PARAMS,
     WEBHOOK_URL,
     JWT_EXPIRES_IN,
     AppConfig,
@@ -1286,6 +1287,8 @@ class OAuthManager:
         kwargs = {}
         if auth_manager_config.OAUTH_AUDIENCE:
             kwargs['audience'] = auth_manager_config.OAUTH_AUDIENCE
+        if OAUTH_AUTHORIZE_PARAMS:
+            kwargs.update(OAUTH_AUTHORIZE_PARAMS)
 
         return await client.authorize_redirect(request, redirect_uri, **kwargs)