Vetrix Docs

OAuth

The OAuth pages let an administrator connect the instance to external identity providers and manage the OAuth2 client applications that other software registers against it. OAuth Providers controls the "Sign in with …" buttons your users see, and Registered applications lists every application that can obtain tokens from the instance. This page covers configuring a provider, testing it, setting the account-linking policy, and suspending or deleting a registered application.

Where to find it

Open your avatar menu in the top navigation bar and select Admin panel, or go to gitvetrix.com/admin directly. In the admin sidebar, under Access & Security, select OAuth for identity providers or OAuth Apps for registered applications.

URL patterns: gitvetrix.com/admin/oauth and gitvetrix.com/admin/oauth/apps

Configure an identity provider

The OAuth Providers page shows one panel per built-in identity provider: Google, GitHub, GitLab, and Microsoft. Each panel notes whether the provider signs you in with OpenID Connect (id_token verified) or OAuth2 (userinfo-only). OAuth sign-in is additive: users keep their existing password and two-factor code.

  1. Find the provider's panel and select the Enabled checkbox to turn it on.
  2. In Client ID, paste the client identifier the provider issued for your instance.
  3. In Client secret, paste the secret the provider issued. Select Show to reveal what you type, or Hide to mask it again. When a secret is already stored, this field displays <set>; leaving that value unchanged keeps the stored secret.
  4. In Redirect URL, enter the callback address registered with the provider. It must match the redirect URI registered on the provider's side.
  5. In Scopes (comma-separated), list the scopes to request from the provider, separated by commas.
  6. Select or clear Allow new account creation via provider to decide whether a first-time sign-in through this provider may create a new Vetrix account.
  7. Select Save changes. A confirmation message reports that the provider's settings were saved.

Test a provider's configuration

Before relying on a provider, confirm the instance can reach it.

  1. In the provider's panel, select Test configuration.
  2. Read the result panel that appears. It reports Test result: OK or Test result: Failed, followed by a list of individual checks. Each check shows a check mark when it passes or a cross with a short explanation when it fails.
  3. Fix any reported problem, save your changes, and test again.

Set the account-linking policy

At the top of the OAuth Providers page, one instance-wide setting controls whether an OAuth sign-in may attach to an existing local account.

  1. Read the option Auto-link OAuth logins to existing accounts when the provider asserts a verified email, and the hint beneath it.
  2. Leave the checkbox clear (the recommended setting) to refuse an OAuth sign-in whose email matches an existing local account. Select it to let a verified email from a provider link automatically to a matching account.
  3. Select Save policy. A confirmation message reports that the policy was saved.

Review registered applications

The OAuth Apps page, titled Registered applications, lists every OAuth2 client application registered against the instance. Each row shows:

  • The application's name and its client identifier. Applications created through self-service registration carry a DCR badge.
  • Type — the application's client type.
  • Status — Active or Suspended.
  • Grants — how many consent grants the application holds.
  • Active tokens — how many of its tokens are currently valid.
  • Registered — the date the application was registered.

When no applications have been registered, the page shows No registered applications.

Suspend or reactivate an application

Suspending an application stops its tokens from authenticating immediately, without removing it.

  1. In the application's row, select Suspend.
  2. In the confirmation dialog, review the warning and select the confirm button, which names the application (for example, Suspend app Acme CI).
  3. A confirmation message reports that the application was suspended, and the row now shows Suspended with an Unsuspend action.
  4. To reactivate it, select Unsuspend, confirm, and its existing tokens resume authenticating.

Delete an application

Deleting an application removes it along with all of its consent grants and tokens, and cannot be undone.

  1. In the application's row, select Delete.
  2. In the confirmation dialog, type the application's exact name into the confirmation field to enable the confirm button.
  3. Select the confirm button, which names the application (for example, Delete app Claude DCR).
  4. A confirmation message reports that the application was deleted, and its row disappears from the list.