Skip to content

OAuth 2

Accounts in Shale are not owned by the instance, instead account management is deffered to an external identity provider using OAuth 2. OAuth 2.0 is the industry-standard protocol for authorization.

You can enable an OAuth 2 identity provider in Shale by setting the OAUTH2_CLIENT environment variable during installation.

The OAUTH2_CLIENT environment variable may take two forms depending on which kind of provider you choose to use.

The first is for hosted first-party providers.

OAUTH2_CLIENT: foo|client_id|client_secret

The second is providers that you may host on your own infrasturcture or are provided your own tenant of.

OAUTH2_CLIENT: foo,bar.my.server|client_id|client_secret

When creating a client with your Identity Provider of choice in order to obtain an ID and Secret, one of the pieces of information that it will ask for is a callback/redirect URL. For Shale this should look like http://localhost/-/callback but customized to use your own domain.

Below is the full list of identity providers you may use with Shale:

ProviderShort CodeDeveloper Portal
Amazonamazonhttps://developer.amazon.com/settings/console/securityprofile/overview.html
Battle.netbattle.nethttps://develop.battle.net/access/clients
Discorddiscordhttps://discordapp.com/developers/applications/
Facebookfacebookhttps://developers.facebook.com/apps/
GitHubgithubhttps://github.com/settings/developers
Googlegooglehttps://console.developers.google.com
Microsoftmicrosofthttps://apps.dev.microsoft.com/
Redditreddithttps://www.reddit.com/prefs/apps
Railwayrailwayhttps://railway.com/workspace/developer
ProviderShort CodeHome
Giteagiteahttps://gitea.io/en-us/
Forgejoforgejohttps://forgejo.org/
Codebergforgejo,codeberg.orghttps://codeberg.org/user/settings/applications
Gitlabgitlabhttps://about.gitlab.com/
GitLabgitlab,gitlab.comhttps://gitlab.com/profile/applications
mastodonmastodonhttps://joinmastodon.org/
pleromapleromahttps://pleroma.social/