From 4f5d949af6adab869d812412cd1737dd43f99da2 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Wed, 16 Jul 2025 15:46:33 +0400
Subject: [PATCH] enh: OAUTH_TOKEN_ENDPOINT_AUTH_METHOD

---
 backend/open_webui/config.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py
index 46d3b719a6..4838ee76b2 100644
--- a/backend/open_webui/config.py
+++ b/backend/open_webui/config.py
@@ -445,6 +445,12 @@ OAUTH_TIMEOUT = PersistentConfig(
     os.environ.get("OAUTH_TIMEOUT", ""),
 )
 
+OAUTH_TOKEN_ENDPOINT_AUTH_METHOD = PersistentConfig(
+    "OAUTH_TOKEN_ENDPOINT_AUTH_METHOD",
+    "oauth.oidc.token_endpoint_auth_method",
+    os.environ.get("OAUTH_TOKEN_ENDPOINT_AUTH_METHOD", None),
+)
+
 OAUTH_CODE_CHALLENGE_METHOD = PersistentConfig(
     "OAUTH_CODE_CHALLENGE_METHOD",
     "oauth.oidc.code_challenge_method",
@@ -637,6 +643,13 @@ def load_oauth_providers():
             client_kwargs = {
                 "scope": OAUTH_SCOPES.value,
                 **(
+                    {
+                        "token_endpoint_auth_method": OAUTH_TOKEN_ENDPOINT_AUTH_METHOD.value
+                    }
+                    if OAUTH_TOKEN_ENDPOINT_AUTH_METHOD.value
+                    else {}
+                )
+                ** (
                     {"timeout": int(OAUTH_TIMEOUT.value)} if OAUTH_TIMEOUT.value else {}
                 ),
             }