Werk #22264: New: built-in OAuth 2.0 authorization server (experimental feature)
| Component | User interface | ||||
| Title | New: built-in OAuth 2.0 authorization server (experimental feature) | ||||
| Date | Aug 26, 2026 | ||||
| Level | Prominent Change | ||||
| Class | New Feature | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
This is an experimental feature: its interface, tools, and behavior may still change incompatibly in a future release.
A Checkmk site can now act as its own OAuth 2.0 authorization server. External applications can then obtain access tokens scoped to a specific user's permissions, instead of using that user's password or an unscoped automation secret.
It implements the standard OAuth 2.1 / RFC 6749 authorization code flow with PKCE, RFC 7591 dynamic client registration, and RFC 8414 metadata discovery, so any compliant OAuth client can use it without site-specific configuration:
- A client discovers the site's OAuth endpoints at
/.well-known/oauth-authorization-server/oauth-<site>and registers itself dynamically. No admin action is needed to add a new client. - The user authorizes access on a consent screen that names the requesting application and offers a choice of read only or read & write access. The resulting token is bound to that user's own permissions and expires after 48 hours.
- An admin can revoke a client's tokens at any time from the new Setup page (below).
A new Setup page, Registered OAuth clients (under General), lists every client that has dynamically registered itself and lets an admin delete one client or many at once; deleting a client immediately revokes all tokens issued to it. This page works even when no feature that uses OAuth is currently enabled, so admins can still review or remove clients after disabling the feature.