> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lovable.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect apps to Lovable with OAuth

> Set up Log in with Lovable, choose OAuth scopes, request verification for sensitive scopes, and manage client credentials.

**Log in with Lovable** lets your app ask users to connect their Lovable accounts and authorize access to their profile, projects, or workspaces. Each user signs in to Lovable and reviews the scopes your app requests.

An **OAuth client** is a registration for your app. It defines the app's name, where Lovable sends users after authorization, and which scopes the app can request. Registering a client gives you a **client ID** and **client secret** to configure your integration.

<Note>
  Available on **all plans** when OAuth client management is enabled for the workspace. Only workspace **owners and admins** can register and manage clients. **Sensitive scopes** require **Business or Enterprise**.
</Note>

## Why use OAuth clients

Use OAuth when your app needs to act on behalf of individual Lovable users. For example, an MCP client without a preconfigured Lovable connection can use a custom OAuth client to connect to the Lovable MCP server on each user's behalf, without asking them to share an API key or password.

You choose the scopes your client can request, and each user authorizes the app. OAuth scopes do not expand the user's existing access to projects or workspaces.

For a script that manages a single workspace without asking each user to connect, see [Workspace API keys](/features/api-keys), available on Business and Enterprise plans.

## Common use cases and example apps

Choose scopes based on what your app needs to do. These examples show scopes to consider for common integrations.

| Use case | Example app | Scopes to consider |
| - | - | - |
| Identify a Lovable user | A community portal that recognizes a user's Lovable account | `openid`, `profile`, and `email` |
| Connect another MCP client | A third-party or internal AI assistant without a preconfigured Lovable connection | The project and workspace scopes its tools need |
| Manage projects and view workspace details | A dashboard that shows workspace information and lets users update their projects | `openid`, `projects:write`, and `workspaces:read` |

Add `offline` if your app needs refresh tokens to keep the connection working after the initial access token expires.

For an MCP client that supports custom OAuth credentials, register an OAuth client with the callback URL it provides, then configure it with your client ID and secret. It can connect to the [Lovable MCP server](/integrations/lovable-mcp-server) at `https://mcp.lovable.dev` on behalf of each user who signs in and authorizes access.

## Prerequisites

Before you register a client, make sure you have:

* A workspace with OAuth client management enabled. All plans support non-sensitive scopes. Sensitive scopes require **Business or Enterprise**.
* The **owner or admin** role in that workspace.
* An app or integration that supports the OAuth authorization code flow with **PKCE using S256**. PKCE ties each authorization request to its token exchange.
* A **redirect URI**, also called a callback URL, that your app uses to receive the authorization response.
* A secure backend or connector configuration that can store the client secret and exchange authorization codes for tokens.

## Register an OAuth client

Register your app in the workspace that will own and manage its client credentials.

<Steps>
  <Step title="Open OAuth client settings">
    Select the workspace that will own the client, then go to **Workspace settings → API keys & OAuth → Log in with Lovable**.

    Click **New OAuth client**.
  </Step>

  <Step title="Name your client">
    Enter a descriptive **Client name**, such as `Project reporting dashboard`.
  </Step>

  <Step title="Add redirect URIs">
    Under **Redirect URIs**, enter the callback URL provided by your app or integration, for example `https://example.com/oauth/callback`.

    Click **Add redirect URI** if your integration uses additional callback URLs.
  </Step>

  <Step title="Choose scopes">
    Under **Scopes**, select only the scopes your app needs.

    Scopes are grouped into **Non-sensitive scopes** for sign-in and profile access, and **Sensitive scopes** for project and workspace access. Use the [scope reference](#available-scopes) below to choose scopes. Your app's authorization request must stay within the scopes registered for the client.
  </Step>

  <Step title="Register and save your credentials">
    Click **Register client**. Lovable opens the client's details and shows its **Client ID** and **Client secret**.

    Copy both values into your integration's secure configuration before leaving the page.

    <Warning>
      The client secret is shown only once. Store it securely. Do not put it in browser code, a public repository, or a prompt. If you lose it, generate a new secret and update your integration.
    </Warning>
  </Step>
</Steps>

### Available scopes

Scopes define which data your app can read and which actions it can take on a user's behalf. Registering a scope allows your app to request it. The app must also include it in the authorization request.

**Non-sensitive scopes** are available on all plans. **Sensitive scopes** require a Business or Enterprise workspace.

| Scope | Category | Purpose |
| - | - | - |
| `openid` | Non-sensitive | Identify the signed-in user with OpenID Connect. |
| `profile` | Non-sensitive | Read the user's profile information. |
| `email` | Non-sensitive | Read the user's email address. |
| `offline` | Non-sensitive | Receive refresh tokens when requested during authorization. |
| `projects:read` | Sensitive | Read the user's accessible projects. |
| `projects:write` | Sensitive | Read, create, and modify projects. |
| `workspaces:read` | Sensitive | Read the user's accessible workspaces. |
| `workspaces:write` | Sensitive | Read and modify existing workspaces, subject to the user's existing access. |

## Connect your app

Give your integration the client ID, client secret, registered callback URL, and required scopes. Configure it to use the **authorization code** flow with **PKCE using S256**.

Users sign in to Lovable and authorize the requested scopes. Lovable returns an authorization code to your callback URL, and your backend exchanges it for tokens using the client secret and PKCE verifier. Your app uses the access token to act on the user's behalf.

Use an OAuth or OpenID Connect library to handle PKCE, validate the authorization response and any ID token used for sign-in, and store tokens securely. For refresh tokens, include `offline` in both the client's registered scopes and the authorization request.

<Accordion title="OAuth endpoints">
  Use these production endpoints for a custom integration:

  | Setting | URL |
  | - | - |
  | Issuer | `https://lovable.dev/oauth` |
  | OpenID Connect discovery | `https://lovable.dev/oauth/.well-known/openid-configuration` |
  | Authorization endpoint | `https://lovable.dev/oauth/authorize` |
  | Token endpoint | `https://lovable.dev/oauth/token` |
  | UserInfo endpoint | `https://lovable.dev/oauth/userinfo` |
  | Public signing keys | `https://lovable.dev/oauth/keys` |

  Use the [OpenID Connect discovery document](https://lovable.dev/oauth/.well-known/openid-configuration) to configure your library. It includes capabilities for other client types, so use the scopes and authorization flows described on this page.
</Accordion>

## Manage OAuth clients

After registration, open a client's details to request verification, update its settings, or replace its secret.

### Request verification from Lovable

To protect users, OAuth clients registered with **sensitive scopes** need verification from Lovable. Until a client is verified, users see a warning when authorizing it.

To request verification, open your client from **Workspace settings → API keys & OAuth → Log in with Lovable**, then click **Request approval** next to **Verification**. Once Lovable verifies your client, the warning no longer appears.

### Edit a client

Open the client, click **Edit client**, update its name, redirect URIs, or scopes, and click **Save changes**. The client ID and secret stay the same.

<Warning>
  Changes can affect sign-in for existing integrations. Check your app's callback URLs and requested scopes before saving.
</Warning>

Edits to a verified client that include sensitive scopes create a review request. The current configuration and verified status remain active while Lovable reviews the proposal. Review the proposed settings under **Pending changes** on the client's details page.

You can edit a pending verification request or change request. **Edit client** opens the proposed settings, and saving replaces the pending review with a new request. The current settings stay active until approval, even if the revised proposal removes all sensitive scopes. Use **Withdraw request** if you want to cancel the request. Editing and withdrawal are unavailable once Lovable starts applying an approval.

When no review is pending, edits to unverified clients or changes that leave only non-sensitive scopes apply immediately and reset verification. Clients with only non-sensitive scopes do not need to request verification again.

### Generate a new client secret

Use this if you lose a secret or need to replace one.

1. Open the client and click **Generate new secret** under **Client secret**.
2. Confirm **Generate new secret**.
3. Copy the new secret and update every app or connector configuration that uses this client.
4. Test sign-in and token refresh with the updated configuration.

<Warning>
  The old secret stops working within a few seconds. Sign-in and token refresh fail for integrations that still use it. The new secret is shown only once, so copy it before leaving the page.
</Warning>

## Limitations

Keep these registration limits and supported authorization flows in mind when planning your integration.

* You can register up to **20 OAuth clients per workspace**. Delete an unused client before registering another when you reach this limit.
* Clients support the authorization code flow with PKCE and optional refresh tokens. The client credentials grant for unattended access without a user is not supported.
* Only the eight scopes listed on this page are available.

## FAQ

<AccordionGroup>
  <Accordion title="Which plans and roles can manage OAuth clients?">
    Workspace **owners and admins on all plans** can manage clients when OAuth client management is enabled. Free and Pro support non-sensitive scopes. Sensitive scopes and workspace API keys require **Business or Enterprise**.
  </Accordion>

  <Accordion title="Is this the same as adding Google sign-in to my app?">
    No. OAuth clients let your app request access to a user's **Lovable account**. To let users sign in to a Lovable Cloud app with Google, see [Add Google authentication](/features/google-auth).
  </Accordion>

  <Accordion title="Can users connect before Lovable verifies my client?">
    Yes. Clients with only non-sensitive scopes do not need verification. Clients registered with sensitive scopes show an unverified app warning until Lovable verifies them. Requesting approval alone does not remove the warning.
  </Accordion>

  <Accordion title="Can I view my client secret again?">
    No. Lovable shows the secret only when you register the client or generate a new secret. If you did not save it, generate a replacement and update your integration. The old secret stops working within a few seconds.
  </Accordion>

  <Accordion title="Does selecting a scope automatically give my app access?">
    No. Your app must request that scope during authorization, and the user must authorize the app. Requests also remain subject to the user's existing access to the relevant projects and workspaces.
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="I cannot see Log in with Lovable in settings">
    Check that you are an **owner or admin** and that OAuth client management is enabled for the workspace. All plans can access **Log in with Lovable** when enabled. If settings still shows **Access tokens**, the combined page is not enabled for your workspace yet.
  </Accordion>

  <Accordion title="Sign-in works, but my app does not receive a refresh token">
    Select `offline` in the client's scopes and include it in your app's authorization request. Users must authorize the updated request. If you registered the client through an API, also check that its grant types include `refresh_token`.
  </Accordion>

  <Accordion title="Verification is pending or the status is unavailable">
    Try loading the client again. If **Verification pending** persists, [contact Lovable support](/introduction/support-policy). A pending request or unavailable status does not mean the client is verified.
  </Accordion>
</AccordionGroup>


## Related topics

- [Workspace admin settings](/features/workspace-admin-settings.md)
- [Connect your app to Lightspeed](/integrations/lightspeed.md)
- [App user connectors: let your users connect their own accounts](/integrations/app-user-connectors.md)
- [Lovable API](/integrations/lovable-api.md)
- [Connect your app to Databricks](/integrations/databricks.md)