[GH-ISSUE #735] OAuth to generate token #535

New issue

Open

opened 2026-05-07 00:25:12 +02:00 by BreizhHardware · 4 comments

BreizhHardware commented

2026-05-07 00:25:12 +02:00

Owner

Originally created by @darkdragon-001 on GitHub (May 18, 2023).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/735

💡 Idea
It would be great if OAuth was implemented to generate tokens.
The workflow should look as follows:

App redirects to ntfy web app with special path/query parameters (including redirect URI)
ntfy asks user to login if not done already
ntfy asks user to authorize an application (create a token)
ntfy redirects back to application (using redirect URI) with a generated auth code
App queries ntfy access token by providing auth code

I suggest to use the "Single-Page Apps" workflow which does not require the app to register and maintain a secret.

💻 Target components
web app

Originally created by @darkdragon-001 on GitHub (May 18, 2023). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/735 :bulb: **Idea** It would be great if OAuth was implemented to generate tokens. The workflow should look as follows: - App redirects to ntfy web app with special path/query parameters (including redirect URI) - ntfy asks user to login if not done already - ntfy asks user to authorize an application (create a token) - ntfy redirects back to application (using redirect URI) with a generated auth code - App queries ntfy access token by providing auth code I suggest to use the ["Single-Page Apps" workflow](https://aaronparecki.com/oauth-2-simplified/#single-page-apps) which does _not_ require the app to register and maintain a secret. :computer: **Target components** web app

BreizhHardware added the

enhancement

server

labels

2026-05-07 00:25:12 +02:00

BreizhHardware commented

2026-05-07 00:25:13 +02:00

Author

Owner

@binwiederhier commented on GitHub (May 22, 2023):

What s a use case for this?
ntfy access tokens are full user tokens, i.e. they do not have permission scope such as "can subscribe to topics" or "can change password". So there's a lot of work regarding this.

@binwiederhier commented on GitHub (May 22, 2023): 1. What s a use case for this? 2. ntfy access tokens are full user tokens, i.e. they do not have permission scope such as "can subscribe to topics" or "can change password". So there's a lot of work regarding this.

BreizhHardware commented

2026-05-07 00:25:13 +02:00

Author

Owner

@darkdragon-001 commented on GitHub (May 23, 2023):

This would provide an easy way to share tokens with apps to send notifications to protected accounts.
For a first implementation, I think it would be totally fine if only one scope is available (full user scope). Additional scopes can be added later when seen fit.

@darkdragon-001 commented on GitHub (May 23, 2023): 1. This would provide an easy way to share tokens with apps to send notifications to protected accounts. 2. For a first implementation, I think it would be totally fine if only one scope is available (full user scope). Additional scopes can be added later when seen fit.

BreizhHardware commented

2026-05-07 00:25:13 +02:00

Author

Owner

@binwiederhier commented on GitHub (May 23, 2023):

While I don't dismiss the idea entire, I think this is not very high up on my list now. It's a lot of complexity, and right now you're the only requestor. Maybe over time more 👍 will come.

@binwiederhier commented on GitHub (May 23, 2023): While I don't dismiss the idea entire, I think this is not very high up on my list now. It's a lot of complexity, and right now you're the only requestor. Maybe over time more :+1: will come.

BreizhHardware commented

2026-05-07 00:25:13 +02:00

Author

Owner

@caplam commented on GitHub (Feb 6, 2026):

hello,
i'm currently setting up a notification stack with apprise and ntfy (self hosted).
Almost every service i add on my server which needs user authentication goes through authentik.
Oauth would be great but i guess we could use forward auth on the reverse proxy and use a proxy provider in authentik.
of course we still would have to create user locally but at least we could map authentik user with ntfy user.
I'll try to do that when i'm sure to understand how i can route my different notifications to different users/topics

@caplam commented on GitHub (Feb 6, 2026): hello, i'm currently setting up a notification stack with apprise and ntfy (self hosted). Almost every service i add on my server which needs user authentication goes through authentik. Oauth would be great but i guess we could use forward auth on the reverse proxy and use a proxy provider in authentik. of course we still would have to create user locally but at least we could map authentik user with ntfy user. I'll try to do that when i'm sure to understand how i can route my different notifications to different users/topics