Appwrite

Appwrite Oauth2 API

The OAuth2 service allows you to authorize apps and issue standards-based OAuth2 and OpenID Connect tokens.

GitHub OpenAPI

Operations 14

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /oauth2/{project_id}/approve Approve a consent grant for an OAuth2 app · Approve OAuth2 #
Ask an LLM
“How does my consent screen approve an app's authorization request?”
“Can the approval record which specific resources the user picked?”
Tell an agent
Approve OAuth2 grant {grant_id} in project {project_id}.
Approve grant {grant_id} for project {project_id} with scope {scope} and return the redirect URL.
GET /oauth2/{project_id}/authorize Start OAuth2 authorization via a GET redirect · OAuth2 Authorize #
Ask an LLM
“What URL do I send a user's browser to so they can sign in to my app with Appwrite OAuth2?”
“Can I use PKCE with a code challenge in the authorize query string?”
Tell an agent
Build the GET authorize URL for project {project_id}, client {client_id}, redirecting to {redirect_uri}.
Start a query-string authorization in project {project_id} for client {client_id} with scope {scope} and PKCE challenge {code_challenge}.
POST /oauth2/{project_id}/authorize Start OAuth2 authorization via a form POST · OAuth2 Authorize #
Ask an LLM
“Can I send the authorization request as a POST body instead of URL parameters?”
“Which fields go in the form-post version of the authorize request?”
Tell an agent
POST an authorization request to project {project_id} for client {client_id} with redirect URI {redirect_uri} in the body.
Submit a form-post authorize for project {project_id} using pushed request handle {request_uri}.
POST /oauth2/{project_id}/device_authorization Start a device-code sign-in flow · OAuth2 Device Authorization #
Ask an LLM
“How do I let users sign in on a TV or CLI that has no browser?”
“What does the device authorization step return, like the user code and polling interval?”
Tell an agent
Start device authorization in project {project_id} for client {client_id}.
Get a device code and user code for client {client_id} in project {project_id} with scope {scope}.
POST /oauth2/{project_id}/grants Exchange a device user code for a grant · Create OAuth2 Grant #
Ask an LLM
“What happens after a user types the device code shown on their TV?”
“How is the signed-in user bound to a pending device grant?”
Tell an agent
Redeem device user code {user_code} in project {project_id}.
Bind my session to the pending device grant for code {user_code}, project {project_id}.
GET /oauth2/{project_id}/grants/{grant_id} Get a pending grant for the consent screen · Get OAuth2 Grant #
Ask an LLM
“What details should my consent screen show about the access being requested?”
“Who is allowed to read an OAuth2 grant?”
Tell an agent
Show OAuth2 grant {grant_id} in project {project_id}.
Fetch what grant {grant_id} in project {project_id} asks the user to approve.
GET /oauth2/{project_id}/logout Log out via an OIDC GET redirect · OAuth2 Logout #
Ask an LLM
“What URL do I redirect to for OpenID Connect logout from my app?”
“Will the logout link send the user back to my site afterward?”
Tell an agent destructive · confirm first
Build the GET logout link for project {project_id} with ID token hint {id_token_hint}.
Sign the user out of project {project_id} by query string and return them to {post_logout_redirect_uri}.
POST /oauth2/{project_id}/logout Log out via an OIDC form POST · OAuth2 Logout #
Ask an LLM
“Can I end the session with a POST body instead of logout URL parameters?”
“Which fields does the form-post logout accept?”
Tell an agent destructive · confirm first
POST a logout to project {project_id} with ID token hint {id_token_hint} in the body.
Submit a form-post logout for client {client_id} in project {project_id}, then return to {post_logout_redirect_uri}.
GET /oauth2/{project_id}/organizations List organizations an access token can reach · OAuth2 List Accessible Organizations #
Ask an LLM
“Which organizations does this OAuth2 access token give me access to?”
“How is an organization wildcard in the token expanded?”
Tell an agent
List the organizations my token can access in project {project_id}.
Search organizations accessible to the token in project {project_id} for {search}.
POST /oauth2/{project_id}/par Push an authorization request server-side · OAuth2 PAR #
Ask an LLM
“How do I use pushed authorization requests instead of long authorize URLs?”
“What request_uri handle do I pass to the authorize step?”
Tell an agent
Push an authorization request to project {project_id} for client {client_id}, redirect {redirect_uri}, response type {response_type}.
Create a PAR request_uri in project {project_id} for client {client_id} ({response_type}) returning to {redirect_uri} with scope {scope}.
GET /oauth2/{project_id}/projects List projects an access token can reach · OAuth2 List Accessible Projects #
Ask an LLM
“Which projects can my OAuth2 access token act on?”
“Can I search the projects a token has been granted?”
Tell an agent
List the projects my token can access via project {project_id}.
Search token-accessible projects in {project_id} for {search}.
POST /oauth2/{project_id}/reject Deny a consent grant · Reject OAuth2 #
Ask an LLM
“What happens when a user clicks deny on my consent screen?”
“Where is the user redirected after refusing access?”
Tell an agent
Reject OAuth2 grant {grant_id} in project {project_id}.
Deny consent for grant {grant_id} in project {project_id} and give me the access_denied redirect.
POST /oauth2/{project_id}/revoke Revoke an access or refresh token · OAuth2 Revoke #
Ask an LLM
“How do I invalidate an OAuth2 refresh token?”
“Can I hint whether the token I'm revoking is an access or refresh token?”
Tell an agent destructive · confirm first
Revoke token {token} in project {project_id}.
Revoke {token_type_hint} {token} for client {client_id} in project {project_id}.
POST /oauth2/{project_id}/token Exchange a code or refresh token for tokens · OAuth2 Token #
Ask an LLM
“How do I trade an authorization code for access and refresh tokens?”
“Can I get a new access token using my refresh token?”
Tell an agent
Exchange authorization code {code} for tokens in project {project_id} with grant type {grant_type}.
Refresh my access token in project {project_id} using {refresh_token} and grant type {grant_type}.

Documentation

📖
Documentation
https://appwrite.io/docs
📖
APIReference
https://appwrite.io/docs/references

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/appwrite/refs/heads/main/openapi/appwrite-oauth2-api-openapi.yml

SDKs

📦
GitHubRepository
https://github.com/appwrite/appwrite

Other Resources

🔗
GraphQL
https://raw.githubusercontent.com/api-evangelist/appwrite/refs/heads/main/graphql/appwrite-graphql.md
🔗
GraphQLSchema
https://raw.githubusercontent.com/api-evangelist/appwrite/refs/heads/main/graphql/appwrite-schema.graphql

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/appwrite:appwrite-oauth2-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

appwrite-oauth2-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  version: 2.0.0
  title: Appwrite Oauth2 API
  description: Appwrite backend as a service cuts up to 70% of the time and costs required for building a modern application. We abstract and simplify common development tasks behind a REST APIs, to help you develop your app in a fast and secure way. For full API documentation and tutorials go to https://appwrite.io/docs
  termsOfService: https://appwrite.io/policy/terms
  contact:
    name: Appwrite Team
    url: https://appwrite.io/support
    email: team@appwrite.io
  license:
    name: BSD-3-Clause
    url: https://raw.githubusercontent.com/appwrite/appwrite/master/LICENSE
servers:
- url: https://cloud.appwrite.io/v1
  description: Appwrite Cloud endpoint.
- url: https://{region}.cloud.appwrite.io/v1
  description: Appwrite Cloud regional endpoint. Replace `{region}` with your project region.
  variables:
    region:
      default: fra
      description: Appwrite Cloud region.
tags:


# --- truncated at 32 KB (56 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/appwrite/refs/heads/main/openapi/appwrite-oauth2-api-openapi.yml