Context:
I am attempting to integrate Kakao Login (one of the largest social login providers in South Korea) into my Flutter application using Appwrite's Generic OIDC provider. Kakao supports OpenID Connect (OIDC) standard endpoints, but has strict constraints regarding scope names.
The Problem:
- Appwrite's Generic OIDC server-side implementation enforces/appends standard scopes:
openid, profile, and email to the authorization URL by default. - Even if I pass custom scopes from the client-side SDK (e.g.,
scopes: ['openid', 'profile_nickname', 'account_email'] in Flutter's createOAuth2Session), the Appwrite server still appends the default profile and email scopes to the request sent to Kakao. - Kakao strictly validates requested scopes. It does not recognize the standard
profile or email scopes. Instead, it uses custom scope names: profile_nickname (or profile_image) and account_email. - Because the standard
profile and email scopes are included in the request, Kakao rejects it immediately with an invalid_scope error (Error Code: KOE205), making it impossible to use the Generic OIDC adapter.
Suggested Solution:
- Provide a configuration field in the Appwrite Console under the Generic OIDC settings to customize or override the default scopes.
- Exceptional edit configuration for Kakao.
- Or, ensure that the
scopes parameter passed from the client-side SDK completely overrides (rather than appends to) the default server-side scopes (openid, profile, email) for the OIDC provider.
This will greatly improve OIDC compatibility with local identity providers like Kakao that enforce strict, non-standard scope validation.
TL;DR
There is a compatibility issue when integrating Kakao OpenID Connect with Appwrite's Generic OIDC due to strict scope constraints. The problem arises because Appwrite appends default scopes that Kakao does not recognize. The suggested solution is to provide a configuration field in Appwrite Console to customize scopes or ensure that scopes passed from the client-side SDK completely override default server-side scopes.
