Simple OAuth Personal Consumers

Lets each user create their own API clients for Simple OAuth, for example to connect a script, an integration or an AI agent to the site. A client acts as the user who created it, and a scope allow-list set by the site administrator limits what it may do.

Features

• An API clients tab on the user profile, where users create, list and revoke their own clients.
• Each client is a confidential OAuth2 consumer using the client-credentials grant. The client secret is shown once.
• A token acts as the client's owner: it gets the owner's permissions, limited to the configured scopes. Role changes on the owner apply immediately.
• A site-wide scope allow-list is the ceiling for every client, whatever the owner may do.
• Administrator accounts cannot own personal clients, and a token stops working if its owner becomes an administrator later.
• Revoking a client disables it and deletes its tokens but keeps it, so past actions stay attributed to it.
• Each client records when it was created and when a token was last issued for it.
• Cron removes self-registered clients that nobody authorized within 7 days (configurable).

Use it when users, not only administrators, need to connect tools to the site under their own account and permissions.

Post-Installation

1. Configure Simple OAuth (keys, token expiration).
2. Create the OAuth2 scopes that should limit personal clients, and list their IDs in simple_oauth_personal_consumers.settings:scopes.
3. Grant the permission manage own personal consumers to the roles that may create clients.
4. Users manage their clients at /user/{uid}/api-clients. Clients fetch tokens from /oauth/token with grant_type=client_credentials.

Additional Requirements

• Drupal 11.1 or later
• Simple OAuth 6.1.3 or later, and Consumers

Similar projects

Simple OAuth itself lets administrators create consumers. This module adds self-service clients for users, bound to their owner and capped by scope. Key auth gives users a static API key with their full permissions; this module issues expiring OAuth2 tokens limited to the allowed scopes.

Developed as part of OpenKnowledgebase and released on its own so that other Drupal sites can use it without OpenKB.

Status: the code currently ships inside OpenKnowledgebase and will be moved here before the first release.