Skip to main content
Login with Lovable lets your app ask users to connect their Lovable accounts and authorize access to their profile, projects, or workspaces. Each user signs in to Lovable and reviews the scopes your app requests. An OAuth client is a registration for your app. It defines the app’s name, where Lovable sends users after authorization, and which scopes the app can request. Registering a client gives you a client ID and client secret to configure your integration.
Available on all plans when OAuth client management is enabled for the workspace. Only workspace owners and admins can register and manage clients. Sensitive scopes require Business or Enterprise.

​
Why use OAuth clients

Use OAuth when your app needs to act on behalf of individual Lovable users. For example, an MCP client without a preconfigured Lovable connection can use a custom OAuth client to connect to the Lovable MCP server on each user’s behalf, without asking them to share an API key or password. You choose the scopes your client can request, and each user authorizes the app. OAuth scopes do not expand the user’s existing access to projects or workspaces. For a script that manages a single workspace without asking each user to connect, see Workspace API keys, available on Business and Enterprise plans.

​
Common use cases and example apps

Choose scopes based on what your app needs to do. These examples show scopes to consider for common integrations. Add offline if your app needs refresh tokens to keep the connection working after the initial access token expires. For an MCP client that supports custom OAuth credentials, register an OAuth client with the callback URL it provides, then configure it with your client ID and secret. It can connect to the Lovable MCP server at https://mcp.lovable.dev on behalf of each user who signs in and authorizes access.

​
Prerequisites

Before you register a client, make sure you have:
  • A workspace with OAuth client management enabled. All plans support non-sensitive scopes. Sensitive scopes require Business or Enterprise.
  • The owner or admin role in that workspace.
  • An app or integration that supports the OAuth authorization code flow with PKCE using S256. PKCE ties each authorization request to its token exchange.
  • A redirect URI, also called a callback URL, that your app uses to receive the authorization response.
  • A secure backend or connector configuration that can store the client secret and exchange authorization codes for tokens.

​
Register an OAuth client

Register your app in the workspace that will own and manage its client credentials.
1

Open OAuth client settings

Select the workspace that will own the client, then go to Workspace settings → API keys & OAuth → Login with Lovable.Click New OAuth client.
2

Name your client

Enter a descriptive Client name, such as Project reporting dashboard.
3

Add redirect URIs

Under Redirect URIs, enter the callback URL provided by your app or integration, for example https://example.com/oauth/callback.Click Add redirect URI if your integration uses additional callback URLs.
4

Choose scopes

Under Scopes, select only the scopes your app needs.Scopes are grouped into Non-sensitive scopes for sign-in and profile access, and Sensitive scopes for project and workspace access. Use the scope reference below to choose scopes. Your app’s authorization request must stay within the scopes registered for the client.
5

Register and save your credentials

Click Register client. Lovable opens the client’s details and shows its Client ID and Client secret.Copy both values into your integration’s secure configuration before leaving the page.
The client secret is shown only once. Store it securely. Do not put it in browser code, a public repository, or a prompt. If you lose it, generate a new secret and update your integration.

​
Available scopes

Scopes define which data your app can read and which actions it can take on a user’s behalf. Registering a scope allows your app to request it. The app must also include it in the authorization request. Non-sensitive scopes are available on all plans. Sensitive scopes require a Business or Enterprise workspace.

​
Connect your app

Give your integration the client ID, client secret, registered callback URL, and required scopes. Configure it to use the authorization code flow with PKCE using S256. Users sign in to Lovable and authorize the requested scopes. Lovable returns an authorization code to your callback URL, and your backend exchanges it for tokens using the client secret and PKCE verifier. Your app uses the access token to act on the user’s behalf. Use an OAuth or OpenID Connect library to handle PKCE, validate the authorization response and any ID token used for sign-in, and store tokens securely. For refresh tokens, include offline in both the client’s registered scopes and the authorization request.
Use these production endpoints for a custom integration:Use the OpenID Connect discovery document to configure your library. It includes capabilities for other client types, so use the scopes and authorization flows described on this page.

​
Manage OAuth clients

After registration, open a client’s details to request verification, update its settings, or replace its secret.

​
Request verification from Lovable

To protect users, OAuth clients registered with sensitive scopes need verification from Lovable. Until a client is verified, users see a warning when authorizing it. To request verification, open your client from Workspace settings → API keys & OAuth → Login with Lovable, then click Request approval next to Verification. Once Lovable verifies your client, the warning no longer appears.

​
Edit a client

Open the client, click Edit client, update its name, redirect URIs, or scopes, and click Save changes. The client ID and secret stay the same.
Changes can affect sign-in for existing integrations. Check your app’s callback URLs and requested scopes before saving.
Edits to a verified client that include sensitive scopes create a review request. The current configuration and verified status remain active while Lovable reviews the proposal. Review the proposed settings under Pending changes on the client’s details page. You can edit a pending verification request or change request. Edit client opens the proposed settings, and saving replaces the pending review with a new request. The current settings stay active until approval, even if the revised proposal removes all sensitive scopes. Use Withdraw request if you want to cancel the request. Editing and withdrawal are unavailable once Lovable starts applying an approval. When no review is pending, edits to unverified clients or changes that leave only non-sensitive scopes apply immediately and reset verification. Clients with only non-sensitive scopes do not need to request verification again.

​
Generate a new client secret

Use this if you lose a secret or need to replace one.
  1. Open the client and click Generate new secret under Client secret.
  2. Confirm Generate new secret.
  3. Copy the new secret and update every app or connector configuration that uses this client.
  4. Test sign-in and token refresh with the updated configuration.
The old secret stops working within a few seconds. Sign-in and token refresh fail for integrations that still use it. The new secret is shown only once, so copy it before leaving the page.

​
Limitations

Keep these registration limits and supported authorization flows in mind when planning your integration.
  • You can register up to 20 OAuth clients per workspace. Delete an unused client before registering another when you reach this limit.
  • Clients support the authorization code flow with PKCE and optional refresh tokens. The client credentials grant for unattended access without a user is not supported.
  • Only the eight scopes listed on this page are available.

​
FAQ

Workspace owners and admins on all plans can manage clients when OAuth client management is enabled. Free and Pro support non-sensitive scopes. Sensitive scopes and workspace API keys require Business or Enterprise.
No. OAuth clients let your app request access to a user’s Lovable account. To let users sign in to a Lovable Cloud app with Google, see Add Google authentication.
Yes. Clients with only non-sensitive scopes do not need verification. Clients registered with sensitive scopes show an unverified app warning until Lovable verifies them. Requesting approval alone does not remove the warning.
No. Lovable shows the secret only when you register the client or generate a new secret. If you did not save it, generate a replacement and update your integration. The old secret stops working within a few seconds.
No. Your app must request that scope during authorization, and the user must authorize the app. Requests also remain subject to the user’s existing access to the relevant projects and workspaces.

​
Troubleshooting

Check that you are an owner or admin and that OAuth client management is enabled for the workspace. All plans can access Login with Lovable when enabled. If settings still shows Access tokens, the combined page is not enabled for your workspace yet.
Select offline in the client’s scopes and include it in your app’s authorization request. Users must authorize the updated request. If you registered the client through an API, also check that its grant types include refresh_token.
Try loading the client again. If Verification pending persists, contact Lovable support. A pending request or unavailable status does not mean the client is verified.