---
schema: rendered-html/v1
title: "OAuth 2.0 Authorization in Hub | Developer Portal for YouTrack and Hub Documentation"
source_url: https://www.jetbrains.com/help/youtrack/devportal/OAuth-authorization-in-hub.html
generated_at: 2026-06-11T14:43:58.297459+00:00
---

Feedback

Thanks for your feedback!

Was this page helpful?

YesNo

Developer Portal for YouTrack and Hub

- Developer Portal
- Apps
- MCP Tools
- YouTrack Workflows
- YouTrack Import Scripts
- YouTrack Form API
- YouTrack REST API
- Hub REST API
- Hub REST API Guide
- Log in to Hub
- Permanent Token Authorization in Hub
- [OAuth 2.0 Authorization in Hub](OAuth-authorization-in-hub.html)
- Implicit
- Authorization Code
- [Refresh Token](jetbrains__com__help__youtrack__devportal__refresh-token.md)
- [Resource Owner Password Credentials](jetbrains__com__help__youtrack__devportal__resource-owner-password-credentials.md)
- Client Credentials
- Extension Grants
- [OAuth 2.0 Errors](jetbrains__com__help__youtrack__devportal__oauth-2.0-errors.md)
- REST API URL and Endpoints
- Hub OpenAPI Specification (OAS)
- Hub API Field Syntax
- Sort Syntax in Hub
- Hub API Query Syntax
- Hub REST API Reference

1. Hub REST API
2. Hub REST API Guide
3. Log in to Hub
4. [OAuth 2.0 Authorization in Hub](#0)

# OAuth 2.0 Authorization in Hub﻿

Last modified: 07 May 2026

Hub implementation of [OAuth 2.0](https://tools.ietf.org/html/rfc6749) supports several authentication/authorization flows. To access resources of Hub itself and services connected to Hub, a client should obtain an access token. The flow that the client may use depends on:

- What information the client has (service credentials / user credentials).
- The application type (browser / server side application / standalone application).

## What Flow to Use?﻿

| You develop... | Flow to use | Required parameters | Additional requirement |
| --- | --- | --- | --- |
| A rich client web application with all authorization logic in browser | Implicit flow | `service id` | Handle in browser request with a grant from Hub |
| A web application with the authorization login on the server side | Authorization Code flow | `service id`, `service secret` | Handle request with a grant from Hub server on server side |
| A desktop or a mobile application able to request authorization token non-interactively | [Refresh Token flow](jetbrains__com__help__youtrack__devportal__refresh-token.md) | `service id`, `service secret` | Handle request with a grant from Hub server on server side |
| A script that needs to access resources on behalf of itself | Client Credentials flow | `service id`, `service secret` | None |
| A script that needs to access resources on behalf of some user | [Resource Owner Password Credentials flow](jetbrains__com__help__youtrack__devportal__resource-owner-password-credentials.md) | `service id`, `service secret`, `username` and `password` | None |

## What Information You Should Have﻿

| Parameter | Is it required? | Description |
| --- | --- | --- |
| `Client service ID` | **Always** | An identifier (ID) of the service associated with the client in Hub. |
| `Client service secret` | Depends on flow | A secret for the service associated with the client in Hub. |
| `Scope` | **Always** | An ID of the registered in Hub service associated with the resource server. For example, if the client wants to access issues in YouTrack, it should find out the id of YouTrack service in Hub.  The client can access more then one resource server with a single access token. In this case, the Scope is the space-separated list of the IDs of the services registered in Hub. |
| `Client redirect URI` | Depends on flow | An URI at the client application that can handle response from authorization server (Hub). |
| `Username` | Depends on flow | End-user's username, or id, or email. |
| `Password` | Depends on flow | End-user's password. |

## OAuth 2.0 Endpoints for Hub﻿

For the Hub service, the OAuth 2.0 endpoints for authentication and token are:

- Authentication endpoint URL: `<Hub Service URL>/api/rest/oauth2/auth`
- Token endpoint URL: `<Hub Service URL>/api/rest/oauth2/token`

`<Hub Service URL>` is the URL that is configured for the Hub service in your network environment. For example, you have your company's server `www.mycompany.com` and a Hub service. You can configure Hub to be accessible by `www.mycompany.com/hub` or, let's say `hub.mycompany.com`. Subsequently, the OAuth 2.0 endpoints are as follows, respectively:

- For `www.mycompany.com/hub`: `https://www.mycompany.com/hub/api/rest/oauth2/auth` and `https://www.mycompany.com/hub/api/rest/oauth2/token`
- For `hub.mycompany.com`: `https://hub.mycompany.com/api/rest/oauth2/auth` and `https://hub.mycompany.com/api/rest/oauth2/token`.

If you need to get the user info and further data, please check the description of OpenID Connect endpoint.

## Register Client as a Service﻿

To enable authorization you should register your client as a Hub service. You can do it either in administrative UI or programmatically. Basically, you just send `POST` request on `/services` URL and get credentials of the newly created service in response.

### Sample script for registering client as a service﻿

The following sample script considers Hub service to be installed to `https://hub.company.com` and a client OAuth 2.0 service - to `https://myservice.company.com`.

#### Request﻿

```
POST /api/rest/services?fields=id,secret HTTP/1.1
Host: hub.company.com
Accept: application/json
Content-Type: application/json

{
"name": "My Service",
"homeUrl": "https://myservice.company.com",
"redirectUris": ["https://myservice.company.com/authorized"],
"applicationName": "My Service",
"vendor": "Company Inc.",
"version": "1.0"
}
```

#### Response﻿

```
{
"id": "98071167-004c-4ddf-ba37-5d4599fdf319",
"secret": "eAUyKgVfhSbV"
}
```

You can later use service's `id` and `secret` for authorization.

Service in Hub can be either trusted or not. If a service is trusted, then it can access Hub resource servers on behalf of itself. Also, when a user is sent from the trusted service to authorize himself, the user sees no additional warning.

- [OAuth 2.0 Authorization in Hub](/help/youtrack/devportal/OAuth-authorization-in-hub.html)
- [What Flow to Use?](/help/youtrack/devportal/OAuth-authorization-in-hub.html#oauth-authorization-flows)
- [What Information You Should Have](/help/youtrack/devportal/OAuth-authorization-in-hub.html#oauth-authorization-requirements)
- [OAuth 2.0 Endpoints for Hub](/help/youtrack/devportal/OAuth-authorization-in-hub.html#HubOauthEndpoints)
- [Register Client as a Service](/help/youtrack/devportal/OAuth-authorization-in-hub.html#oauth-authorization-service-registration)

Permanent Token Authorization in HubImplicit

- Privacy & Security
- Terms Of Use
- Trademarks
- Legal

Copyright © 2000–2026 JetBrains s.r.o.
