{"templateId":"markdown","versions":[{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/deployment/reference/oauth-server","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/v1.39/deployment/reference/oauth-server","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/deployment/reference/oauth-server","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/deployment/reference/oauth-server","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/deployment/reference/oauth-server","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/deployment/reference/oauth-server","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/deployment/reference/oauth-server","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"OAuth server configuration","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"oauth-server-configuration","__idx":0},"children":["OAuth server configuration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this page to understand the OAuth server configuration fields for ","Ripple Custody",". The example shows one possible component configuration; token policy, client setup, resource values, private key storage, and ingress depend on your deployment."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page applies to on-premise deployments only. For current defaults and the full supported schema, use the configuration packaged with your release."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-this-config-controls","__idx":1},"children":["What this config controls"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The OAuth server acts as an OIDC provider for ","Ripple Custody",". It issues and validates tokens, exposes discovery metadata and JWKS, and supports OAuth clients used by the platform."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Supported grant types documented in this reference:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Grant type"},"children":["Grant type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authorization_code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authorization code flow for web applications."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Service-to-service authentication. Usually used for read-only API requests; system-signed intent proposals require the separate system-signed intent setup and matching policies."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["password"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Password grant for trusted applications."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Token refresh."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"environment-variables","__idx":2},"children":["Environment variables"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Variable"},"children":["Variable"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Example or source"},"children":["Example or source"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POSTGRES_URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["PostgreSQL connection URL."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["DEBUG"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Debug logging namespace."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["oidc-provider:*"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Additional OAuth server environment variables are managed by the deployment configuration unless explicitly exposed."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Token lifetime and session settings are configured in Keycloak realm settings, not directly in the OAuth server. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/reference/keycloak"},"children":["Keycloak configuration"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"component-fields","__idx":3},"children":["Component fields"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Location: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["components.oauth"]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["enabled"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enables the OAuth component."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["replicas"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Number of OAuth server replicas."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resources.requests"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CPU and memory requests."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resources.limits"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CPU and memory limits."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secrets.server"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret configuration for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OAUTH_SERVER_KEY"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secrets.psql"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret reference for database connection values."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secrets.oidc-credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret reference for OIDC credentials."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secrets.clients"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret reference for OAuth client definitions."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ingress.main"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ingress settings for the OAuth endpoint."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Resource and replica values are workload-dependent. Set them based on expected authentication load and observed runtime behavior."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"private-key","__idx":4},"children":["Private key"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The OAuth server requires private key material for signing JWT tokens."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Expected secret key:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Secret"},"children":["Secret"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Key"},"children":["Key"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["oauth-server"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OAUTH_SERVER_KEY"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Private key used by the OAuth server."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the complete authentication secret map, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/reference/auth-secrets"},"children":["Secret management for authentication"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication-flows","__idx":5},"children":["Authentication flows"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Internal OAuth clients are configured by the deployment. For how API authentication works, see:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/authentication/overview"},"children":["Authentication"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/authentication/authenticate-api-requests"},"children":["Authenticate API requests"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example","__idx":6},"children":["Example"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This example shows one possible OAuth component configuration:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"components:\n  oauth:\n    enabled: true\n    replicas: 2\n    resources:\n      limits:\n        cpu: 1000m\n        memory: 512Mi\n      requests:\n        cpu: 100m\n        memory: 128Mi\n    secrets:\n      server:\n        secretRef: oauth-server\n      psql:\n        secretRef: oauth-psql\n      oidc-credentials:\n        secretRef: oauth-oidc-credentials\n      clients:\n        secretRef: oauth-clients\n    ingress:\n      main:\n        enabled: true\n        hosts:\n          - host: \"openid.example.com\"\n            paths:\n              - path: /\n                pathType: Prefix\n        tls:\n          - secretName: oauth-tls\n            hosts:\n              - openid.example.com\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example private key secret shape:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"apiVersion: v1\nkind: Secret\nmetadata:\n  name: oauth-server\ntype: Opaque\nstringData:\n  OAUTH_SERVER_KEY: |\n    -----BEGIN PRIVATE KEY-----\n    <private-key-material>\n    -----END PRIVATE KEY-----\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-topics","__idx":7},"children":["Related topics"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/reference/keycloak"},"children":["Keycloak configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/reference/auth-secrets"},"children":["Secret management for authentication"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/reference/networking"},"children":["Networking configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/reference/postgresql"},"children":["PostgreSQL configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/genesis/payload-reference"},"children":["Genesis payload reference"]}]}]}]},"headings":[{"value":"OAuth server configuration","id":"oauth-server-configuration","depth":1},{"value":"What this config controls","id":"what-this-config-controls","depth":2},{"value":"Environment variables","id":"environment-variables","depth":2},{"value":"Component fields","id":"component-fields","depth":2},{"value":"Private key","id":"private-key","depth":2},{"value":"Authentication flows","id":"authentication-flows","depth":2},{"value":"Example","id":"example","depth":2},{"value":"Related topics","id":"related-topics","depth":2}],"frontmatter":{"seo":{"title":"OAuth server configuration"}},"lastModified":"2026-08-05T09:55:07.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/deployment/reference/oauth-server","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}