Skip to main content

OAuth

OAuth is optional. When a provider configuration is complete, regex101 enables that provider.

If no provider is complete, regex101 disables OAuth sign-in.

Configure the public origin​

Set OAUTH_ORIGIN to the public origin of your regex101 deployment:

OAUTH_ORIGIN=https://regex101.example.com

Use HTTPS for a production deployment. The origin must match the URL that users open.

Register these callback URLs for the providers that you enable:

ProviderCallback URL
Google<OAUTH_ORIGIN>/connect/google/callback
GitHub<OAUTH_ORIGIN>/connect/github/callback
Custom OIDC<OAUTH_ORIGIN>/connect/custom/callback

Google​

  1. Create an OAuth client in Google Cloud Console.
  2. Select Web application as the application type.
  3. Add <OAUTH_ORIGIN>/connect/google/callback as an authorized redirect URI.
  4. Add the client values to the environment file:
OAUTH_GOOGLE_CLIENT_ID=
OAUTH_GOOGLE_CLIENT_SECRET=

Google is enabled when OAUTH_ORIGIN and both Google values are set.

regex101 requests the openid and email scopes. You do not need to configure scopes in the environment file.

GitHub​

  1. Create an OAuth App in the GitHub developer settings.
  2. Set its homepage URL to OAUTH_ORIGIN.
  3. Set its callback URL to <OAUTH_ORIGIN>/connect/github/callback.
  4. Add the client values to the environment file:
OAUTH_GITHUB_CLIENT_ID=
OAUTH_GITHUB_CLIENT_SECRET=

GitHub is enabled when OAUTH_ORIGIN and both GitHub values are set.

regex101 requests the user:email scope. You do not need to configure scopes in the environment file.

Custom OpenID Connect provider​

The custom provider supports services that offer OpenID Connect discovery. These services include Microsoft Entra ID, Okta, Auth0, and Keycloak.

  1. Create an OpenID Connect application in your identity provider.
  2. Add <OAUTH_ORIGIN>/connect/custom/callback as its redirect URI.
  3. Add the provider values to the environment file:
OAUTH_CUSTOM_LABEL=Company sign-in
OAUTH_CUSTOM_ISSUER=https://login.microsoftonline.com/<tenant-id>/v2.0
OAUTH_CUSTOM_CLIENT_ID=
OAUTH_CUSTOM_CLIENT_SECRET=
OAUTH_CUSTOM_AUTH_METHOD=header

The custom provider is enabled when OAUTH_ORIGIN, the issuer, the client ID, and the client secret are set.

OAUTH_CUSTOM_LABEL is optional. Its value is the provider name that users see. The default label is Single sign-on.

For Microsoft Entra ID, replace <tenant-id> with your directory tenant ID. Use a tenant-specific issuer for an enterprise deployment.

The configured issuer must exactly match the issuer value in the discovery response. The comparison includes the complete path and trailing slash.

Microsoft Entra ID returns a tenant-specific issuer. Thus, do not use the common or organizations issuer.

OAUTH_CUSTOM_AUTH_METHOD controls client authentication at the token endpoint. The supported values are:

  • header uses client_secret_basic. This value is the default.
  • body uses client_secret_post. If your provider requires client_secret_post, use this value.

regex101 requests the openid, email, and profile scopes. You do not need to configure scopes in the environment file.

Enable the providers​

Save the environment file after you add the provider configuration. Then restart the application:

./start.sh

You can enable more than one provider. If one provider is incomplete, regex101 disables only that provider.