OAuth 2.0 Applications¶

Enable OAuth 2.0 Applications¶

OAuth 2.0 applications are off by default and can be enabled by the System Administrator as follows:

1 - Login to your Mattermost server as the System Administrator.

2 - Go to Main Menu > System Console > Integrations > Custom Integrations.

3 - Set Enable OAuth 2.0 Service Provider to True.

4 - (Optional) If you would like to allow external applications to post with customizable usernames and profile pictures, then set Enable integrations to override usernames and Enable integrations to override profile picture icons to True.

5 - (Optional) If you would like to allow users on your system who are not System Admins to create OAuth 2.0 applications, then set Restrict managing integrations to Admins to False.

Register an OAuth 2.0 Application¶

1 - Go to Main Menu > Integrations

2 - Click OAuth 2.0 Applications, then click Add OAuth 2.0 Application

3 - Set Is Trusted: When set to Yes, your application is considered trusted by Mattermost. This means Mattermost doesn’t require users to accept authorization when signing to third-party applications. When set to No, users will be provided with the following page to accept or deny authorization when authenticating for the first time.

4 - Specify the Display Name: Enter a name for your application made of up to 64 characters. This is the name users will see when granting access to the application, when viewing a list of authorized applications in Account Settings > Security > OAuth 2.0 Applications and when viewing a list of OAuth 2.0 applications in Main Menu > Integrations.

5 - Add Description: This is a short description of your application that users will see when viewing a list of authorized applications in Account Settings > Security > OAuth 2.0 Applications.

6 - Specify the Homepage: This is the homepage of the OAuth 2.0 application and lets users visit the app page to learn more what it does. The URL must be a valid URL and start with http:// or https:// depending on your server configuration.

7 - (Optional) Add Icon URL: The image users will see when viewing a list of authorized applications in Account Settings > Security > OAuth 2.0 Applications and when viewing a list of OAuth 2.0 applications in Main Menu > Integrations. Must be a valid URL and start with http:// or https://.

8 - Add Callback URLs: These are the URL(s) to which Mattermost will redirect users after accepting or denying authorization of your application, and which will be the only URL(s) that handle authorization codes or access tokens. If more than one URL is specified, users will be redirected to the URL used for the initial authorization of the app. Each URL must be on a separate line and start with http:// or https://.

9 - Click Save to create the application.

10 - You will be provided with a Client ID, Client Secret and the authorized redirect URLs. Save these values and use them in your application to connect it to Mattermost.

Note: Client Secret can be regenerated by the application creator or System Administrator. Tokens created with the old secret will remain valid and authorization of existing users will continue to work; however, new authorizations and requests for new tokens will fail until the client secret has been updated in your app configuration.