OAuth logins in Rocket.Chat can complete fully on the server, providing stronger protection against phishing and token theft. This guide explains what the modern OAuth flow changes and how to enable it for your workspace.
This feature is available since Rocket.Chat 8.7.0.
Overview
When the modern OAuth flow is enabled, the token exchange with your OAuth provider happens on the Rocket.Chat server instead of in the user's browser. This reduces exposure to token theft, phishing, and credential interception on the client. Each login request also carries Cross-Site Request Forgery (CSRF) protection, state validation, and Proof Key for Code Exchange (PKCE).
The modern flow is the recommended configuration. It is disabled by default so that existing workspaces keep their current behavior until an admin opts in. Enabling it does not change your provider configurations, and users see the same login buttons on the sign-in page.
Prerequisites
Before you begin, ensure that:
You have admin access to your Rocket.Chat workspace.
Your workspace is on Rocket.Chat version 8.7.0 or later.
At least one OAuth provider is configured in Manage → Workspace → OAuth.
Enable the modern OAuth flow
To enable the modern OAuth flow:
Navigate to Manage → Workspace → OAuth.
Enable Use Modern OAuth Flow.
Click Save changes.
OAuth logins now run through the server-side flow for all configured providers.
Setting | Description | Default |
|---|---|---|
Use Modern OAuth Flow ( | When enabled, OAuth authentication completes on the server with CSRF protection, state validation, and PKCE. When disabled, the original browser-based flow is used for backward compatibility. | Disabled |
What changes for users
Sign-in experience: The login buttons for providers such as Google, GitHub, and GitLab remain the same.
Two-factor authentication: Users who have two-factor authentication enabled via email or a time-based one-time password (TOTP) app are asked to complete the 2FA challenge even when they sign in with an OAuth provider.
Mobile and desktop apps: The apps complete OAuth logins through a secure deep-link callback instead of exchanging tokens inside the app.
Revert to previous flow
To return to the original browser-based flow, disable Use Modern OAuth Flow in Manage → Workspace → OAuth. Your provider configurations are not affected.