OAuth with FusionAuth

FusionAuth is a customer identity and access management platform for login, registration, multi-factor authentication, and single sign-on. You can run it on your own infrastructure or use FusionAuth Cloud.

How does the integration work?

You can use the FusionAuth OAuth adapter in Appwrite Auth to sign users in through your FusionAuth instance. Appwrite redirects users to FusionAuth's hosted login pages, exchanges the authorization code for tokens, and creates an Appwrite user from the OpenID Connect user info. Your users keep a single identity in FusionAuth, and your app gets Appwrite sessions, permissions, and APIs on top of it.

Appwrite requests the openid, profile, and email scopes, plus offline_access for a refresh token. It marks the user's email as verified only when FusionAuth returns email_verified as true.

Prerequisites

• A FusionAuth instance served over HTTPS. Appwrite calls its token and user info endpoints from the server, so the instance must be reachable from your Appwrite project.
• Access to the FusionAuth admin UI.

How to implement

To implement the FusionAuth OAuth adapter in Appwrite Auth, there are several steps you must complete:

Step 1: Create an application in FusionAuth

In the FusionAuth admin UI, click Applications in the left navigation, then Add. Enter a Name, select the Tenant your users belong to, and open the OAuth tab.

Under Enabled grants, keep Authorization Code enabled, and keep Refresh Token enabled if you want Appwrite to receive refresh tokens. New applications enable both by default. Click Save.

Reopen the application and save the Client Id and Client secret from the OAuth tab for later use. You'll add the redirect URL after you configure Appwrite in the next step.

Step 2: Add FusionAuth OAuth adapter to your Appwrite project

For this step, you must create an account on Appwrite Cloud or self-host Appwrite if you haven't already. In your Appwrite project, head over to the Auth page, open the Settings tab, and click FusionAuth under the OAuth2 Providers section.

Fill in the provider form:

• Client ID: the application's Client Id.
• Client Secret: the application's Client secret.
• Domain: the host name of your FusionAuth instance without https://, for example example.fusionauth.io. Appwrite builds the endpoints from it, such as https://example.fusionauth.io/oauth2/authorize.

Turn the provider on and click Update. Appwrite won't enable the provider until the Domain field is set.

Copy the Redirect URI shown in the form. On Appwrite Cloud it looks like https://<REGION>.cloud.appwrite.io/v1/account/sessions/oauth2/callback/fusionauth/<PROJECT_ID>, but always copy the exact value from the Console. In FusionAuth, edit the application and add it to Authorized redirect URLs on the OAuth tab. FusionAuth rejects redirect URLs that aren't listed.

Step 3: Test the provider

Start a session from your app with the OAuthProvider.Fusionauth value. With the Web SDK:

import { Client, Account, OAuthProvider } from 'appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>');

const account = new Account(client);

account.createOAuth2Session({
    provider: OAuthProvider.Fusionauth,
    success: 'https://example.com/success',
    failure: 'https://example.com/failed',
});

Add your app's domain as a web platform in your Appwrite project so Appwrite accepts the success and failure URLs. Follow the OAuth 2 login flow for other platforms and for server-side sign-in.

Read more about FusionAuth and Appwrite Auth

If you would like to learn more about FusionAuth and Appwrite Auth, we have some resources that you should visit: