OAuth2 and OIDC for add-ons

02What the module does

• The add-on never sees your passwordDraivix acts as an OAuth2 and OpenID Connect authorization server, authenticating users for add-ons. The add-on receives a token, never the user’s password.
• Sign-in protected by PKCEThe add-on signs in using an authorization code with mandatory PKCE—code protection designed for public clients like add-ons. This binds the authorization code directly to the add-on that requested it.
• Time-limited accessAn access token is valid for 60 minutes and a refresh token for 30 days. Add-ons never hold permanent access; token lifetimes cannot be changed in this version.
• The add-on knows who is signed inThe add-on receives user details via OpenID Connect under the openid, profile, and email scopes, allowing it to identify the user without separate login credentials.
• Two ready-to-use add-onsAn administrator can create a client for the password vault browser extension or the bug-reporting add-on. New add-ons are added through a system update rather than in settings.
• Allowed roles per clientFor each client, you track allowed roles and permission scopes. Scopes are currently enforced only by the password vault; other add-ons act with the permissions of the user who granted access.
• Controlled redirect URIsPost-login redirect URIs are managed separately for each add-on, giving the administrator control over where users return after signing in.
• The password vault enforces its scopesThe password vault enforces the vault:read and vault:write scopes, ensuring the browser extension can do only what its scope permits and nothing more.
• Enable or revoke clients anytimeAdministrators control whether a client is active and can revoke it at any time, keeping full control over which add-ons can gain access.
• All 9 capabilities in a single module

05Frequently asked questions