{"id":45112,"date":"2026-06-08T10:00:00","date_gmt":"2026-06-08T09:00:00","guid":{"rendered":"https:\/\/churchtools.academy\/help\/non-knowledgebase\/uncategorized\/oauth-between-two-churchtools-systems\/"},"modified":"2026-06-22T15:25:58","modified_gmt":"2026-06-22T14:25:58","password":"","slug":"oauth-authentication-with-churchtools","status":"publish","type":"docs","link":"https:\/\/churchtools.academy\/en\/help\/system-settings\/oauth-login-systemsettings\/oauth-authentication-with-churchtools\/","title":{"rendered":"OAuth Authentication with ChurchTools"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this guide, we&#8217;ll show you how to link <strong>two ChurchTools systems<\/strong> together. One of the two systems serves as the authentication server for the other system, the client. This means that users of the server system can then log in to the client system. They do not need separate Login credentials for the client.   <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also use this page as a guide if you want to use a <strong>third-party system<\/strong> instead of a second instance of ChurchTools. For example, you could use your ChurchTools as an authentication server for a system like NextCloud, or integrate a different authentication server with your ChurchTools. The configuration in ChurchTools remains the same.<br>Unfortunately, we cannot provide instructions for the other system. Please refer to the help resources provided by the respective software.   <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Prepare the OAuth server<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First, let&#8217;s look at how to add a client to your OAuth server. In the ChurchTools system, navigate to <em>the Login page<\/em> that will serve as the server. This is the system where the users who will be able to log in to the second system are already registered. We describe how to access the Login page in the section <a href=\"https:\/\/churchtools.academy\/en\/help\/system-settings\/login-en\/login-to-and-with-churchtools\/\" data-type=\"docs\" data-id=\"43227\" target=\"_blank\" rel=\"noreferrer noopener\">\u201cLogging In to and with ChurchTools<\/a>.\u201d   <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Click on the <strong>Add OAuth client<\/strong> button. A window opens in which you must give the client a name. You can freely choose the name, it only serves as a unique identifier on the server. In our example, it is called &#8220;ChuToo Client&#8221;.   <\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Add-OAuth-Client.png\"><img fetchpriority=\"high\" decoding=\"async\" width=\"930\" height=\"382\" src=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Add-OAuth-Client.png\" alt=\"Screenshot System settings General Login Add-OAuth-Client\" class=\"wp-image-47182\" style=\"width:624px;height:auto\" srcset=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Add-OAuth-Client.png 930w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Add-OAuth-Client-300x123.png 300w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Add-OAuth-Client-768x315.png 768w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Add-OAuth-Client-360x148.png 360w\" sizes=\"(max-width: 930px) 100vw, 930px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">ChurchTools now creates all the server information that is relevant for a connection. You can find a simplified explanation of the terms used on our help page   <a href=\"https:\/\/churchtools.academy\/en\/help\/system-settings\/oauth-login-systemsettings\/what-is-oauth-login-to-third-party-systems\/\" data-type=\"docs\" data-id=\"25486\">What is OAuth? (Login to third-party systems) <\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The redirect URI is of course missing, as it is provided by the client and must then be entered here.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2025\/12\/System-settings_Login_OAuth_Edit-OAuth-Client.png\"><img decoding=\"async\" width=\"1284\" height=\"1048\" src=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2025\/12\/System-settings_Login_OAuth_Edit-OAuth-Client.png\" alt=\"Screenshot System settings Login OAuth Edit-OAuth-Client\" class=\"wp-image-43869\" srcset=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2025\/12\/System-settings_Login_OAuth_Edit-OAuth-Client.png 1284w, https:\/\/churchtools.academy\/wp-content\/uploads\/2025\/12\/System-settings_Login_OAuth_Edit-OAuth-Client-300x245.png 300w, https:\/\/churchtools.academy\/wp-content\/uploads\/2025\/12\/System-settings_Login_OAuth_Edit-OAuth-Client-1024x836.png 1024w, https:\/\/churchtools.academy\/wp-content\/uploads\/2025\/12\/System-settings_Login_OAuth_Edit-OAuth-Client-768x627.png 768w, https:\/\/churchtools.academy\/wp-content\/uploads\/2025\/12\/System-settings_Login_OAuth_Edit-OAuth-Client-360x294.png 360w\" sizes=\"(max-width: 1284px) 100vw, 1284px\" \/><\/a><\/figure>\n\n\n\n<aside class=\"wp-block-group ct-box ct-box-blue has-background is-vertical is-layout-flex wp-container-core-group-is-layout-1ccdadb1 wp-block-group-is-layout-flex\" style=\"border-radius:8px;border-left-color:#3e70ce;border-left-width:0.5rem;background-color:#f3f5f7;margin-top:var(--wp--preset--spacing--60);margin-bottom:var(--wp--preset--spacing--60)\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0.5rem;margin-right:0.5rem;margin-bottom:0rem;margin-left:0.5rem\"><strong>Note<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"margin-top:0rem;margin-right:0.5rem;margin-bottom:0.5rem;margin-left:0.5rem\">Note the blue message box. When the systems are connected, you still need to assign the necessary permissions to be able to use the server for authentication. You can find more information on this in section 3.  <\/p>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">2. Configure the OAuth client<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Now switch to your client system and open the Login page there too. Open the following input mask via the <strong>Add OAuth server<\/strong> button. Enter the relevant data from the server here.  <\/p>\n\n\n\n<aside class=\"wp-block-group ct-box ct-box-blue has-background is-vertical is-layout-flex wp-container-core-group-is-layout-1ccdadb1 wp-block-group-is-layout-flex\" style=\"border-radius:8px;border-left-color:#3e70ce;border-left-width:0.5rem;background-color:#f3f5f7;margin-top:var(--wp--preset--spacing--60);margin-bottom:var(--wp--preset--spacing--60)\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0.5rem;margin-right:0.5rem;margin-bottom:0rem;margin-left:0.5rem\"><strong>Note<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"margin-top:0rem;margin-right:0.5rem;margin-bottom:0.5rem;margin-left:0.5rem\">Some OAuth servers, such as Google or Microsoft 365\/Entrada ID, require entries in the <em>&#8220;Scope<\/em>&#8221; field. Please refer to the respective provider&#8217;s documentation for more information. You do not need to specify <em>a scope<\/em> for a ChurchTools server.  <\/p>\n<\/aside>\n\n\n\n<p class=\"wp-block-paragraph\">In the lower section of the input form, you can use the <strong>&#8220;Create New Users<\/strong> &#8221; button to specify whether users who do not yet exist on the client should be created when they log in via the server using OAuth. You must then define <em>their person status <\/em>and <em>the department<\/em> and <em>campus<\/em> to which <em>they <\/em>will be assigned. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Edit-OAuth-server.png\"><img decoding=\"async\" width=\"1296\" height=\"942\" src=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Edit-OAuth-server.png\" alt=\"Screenshot System settings General Login Edit-OAuth-server\" class=\"wp-image-47187\" srcset=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Edit-OAuth-server.png 1296w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Edit-OAuth-server-300x218.png 300w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Edit-OAuth-server-1024x744.png 1024w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Edit-OAuth-server-768x558.png 768w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/01\/System-settings_General_Login_Edit-OAuth-server-360x262.png 360w\" sizes=\"(max-width: 1296px) 100vw, 1296px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">If it is important for your connection to the authentication server, fill in the <strong>Client secret<\/strong> field. You can freely assign a password here. No client secret is currently required for the connection to a ChurchTools server.  <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Finally, copy the <strong>client identifier<\/strong> and click <em>Add<\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you then click on the newly added OAuth server, you can also use the &#8221; <em>Registration allowed<\/em> &#8221; button to enable <strong>new user registration<\/strong> in the third-party system.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_Generral_Login_Registration-possible.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1256\" height=\"88\" src=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_Generral_Login_Registration-possible.png\" alt=\"Screenshot System settings Generral Login Registration possible\" class=\"wp-image-70143\" srcset=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_Generral_Login_Registration-possible.png 1256w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_Generral_Login_Registration-possible-300x21.png 300w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_Generral_Login_Registration-possible-1024x72.png 1024w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_Generral_Login_Registration-possible-768x54.png 768w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_Generral_Login_Registration-possible-360x25.png 360w\" sizes=\"(max-width: 1256px) 100vw, 1256px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">That completes your work on the client.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Finalize the OAuth server<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Add redirect URI<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To complete the connection between the two ChurchTools systems, enter the redirect URI on the server&#8217;s Login page. Use the <strong>Add redirect URI<\/strong> button to open the corresponding window and enter the link copied from the client here.<br>All the data required for the connection between the server and client has now been entered. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Assign necessary permission<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To allow users of your ChurchTools server to log in to the ChurchTools client via OAuth, they need the permission <strong>&#8220;Log in to a third-party system using a ChurchTools account&#8221; (Login to External System)<\/strong>. You can find this permission in the <em>Permissions Management<\/em> section under <em>Administration<\/em>. For more information, see our help page <a href=\"https:\/\/churchtools.academy\/de\/help\/system-einstellungen\/login-systemeinstellungen\/login-bei-churchtools\/\" target=\"_blank\" rel=\"noreferrer noopener\">\u201cLogin to and With ChurchTools<\/a>.\u201d  <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Login to the client<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The client&#8217;s Login screen now displays the option to log in via the authentication server. The default ChurchTools login may be hidden and therefore no longer visible. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_General_Login_Login.png\"><img loading=\"lazy\" decoding=\"async\" width=\"536\" height=\"910\" src=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_General_Login_Login.png\" alt=\"Screenshot System settings General Login Login\" class=\"wp-image-70145\" style=\"width:343px\" srcset=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_General_Login_Login.png 536w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_General_Login_Login-177x300.png 177w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/System-settings_General_Login_Login-302x512.png 302w\" sizes=\"(max-width: 536px) 100vw, 536px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">If you select this option, a window will open informing you which Login credentials are being shared from the server to the client. If you agree, you will log in on the client system. This privacy prompt appears only the first time you log in via OAuth.  <\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/Login_Oauth_Info-and-continue.png\"><img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"864\" src=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/Login_Oauth_Info-and-continue.png\" alt=\"Screenshot Login Oauth Info and continue\" class=\"wp-image-70148\" style=\"width:385px;height:auto\" srcset=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/Login_Oauth_Info-and-continue.png 640w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/Login_Oauth_Info-and-continue-222x300.png 222w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/06\/Login_Oauth_Info-and-continue-360x486.png 360w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/a><\/figure>\n\n\n\n<aside class=\"wp-block-group ct-box ct-box-blue has-background is-vertical is-layout-flex wp-container-core-group-is-layout-1ccdadb1 wp-block-group-is-layout-flex\" style=\"border-radius:8px;border-left-color:#3e70ce;border-left-width:0.5rem;background-color:#f3f5f7;margin-top:var(--wp--preset--spacing--60);margin-bottom:var(--wp--preset--spacing--60)\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0.5rem;margin-right:0.5rem;margin-bottom:0rem;margin-left:0.5rem\"><strong>Note<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"margin-top:0rem;margin-right:0.5rem;margin-bottom:0.5rem;margin-left:0.5rem\">Keep in mind that the Login on the client system depends on the settings on the server.<br \/>If the <em>&#8220;Create New User<\/em> &#8221; option is not enabled and you do not have an account on the client system, you will not be able to log in.<br \/>If the <em>\u201cCreate New Person\u201d<\/em> option is enabled, a new account will be created for you on the client if you do not already have one. <em>Your person status<\/em>, <em>department<\/em>, and <em>campus<\/em> depend on the settings on the server. These can be changed later on the client system.  <\/p>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">Important Note Regarding Password Changes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;ve only logged in to a ChurchTools system via OAuth but have never used that system&#8217;s direct Login, then you don&#8217;t have a password for that ChurchTools system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, you can go to your profile in this ChurchTools system and change your password there. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are a few things to keep in mind:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you don&#8217;t have a local password for this system yet, set one now.<\/li>\n\n\n\n<li>If you already had a local password in this system, it will now be changed.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In both cases, however, you are only changing the password for the ChurchTools system you are currently logged into. This does not change the password for the system you used to sign up for this ChurchTools system. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A brief example<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You use Google to sign up for ChurchTools. There is no other option on your Login page. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can still log in to your ChurchTools system and set or change your password there.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, this will only change the password for your ChurchTools account. You don&#8217;t actually need this password because you can only log in through Google. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This means your Google password will remain the same and will not change.<\/p>\n\n\n\n<aside class=\"wp-block-group ct-artikel-zum-weiterlesen has-background is-layout-constrained wp-container-core-group-is-layout-79a8db7e wp-block-group-is-layout-constrained\" style=\"border-radius:8px;background-color:#f9fafb;margin-top:24px;margin-bottom:24px;padding-top:32px;padding-right:24px;padding-bottom:32px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-medium-font-size\">Read more<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/churchtools.academy\/de\/help\/system-einstellungen\/login-systemeinstellungen\/login-bei-churchtools\/\" target=\"_blank\" rel=\"noreferrer noopener\">Login to and with ChurchTools<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/churchtools.academy\/en\/help\/system-settings\/oauth-login-systemsettings\/what-is-oauth-login-to-third-party-systems\/\">What is OAuth? (Login to third-party systems) <\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/churchtools.academy\/de\/help\/system-einstellungen\/oauth-login-systemeinstellungen\/login-bei-drittsystem-nextcloud-einrichten-oauth\/\">OAuth login via ChurchTools on Nextcloud<\/a><\/li>\n<\/ul>\n<\/aside>\n","protected":false},"excerpt":{"rendered":"<p>In this guide, we&#8217;ll show you how to link two ChurchTools systems together. One of the two systems serves as the authentication server for the other system, the client. This means that users of the server system can then log in to the client system. They do not need separate Login credentials for the client. [&hellip;]<\/p>\n","protected":false},"author":43,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"doc_category":[699],"doc_tag":[],"knowledge_base":[425],"class_list":["post-45112","docs","type-docs","status-publish","hentry","doc_category-oauth-login-systemsettings","knowledge_base-system-settings"],"pp_statuses_selecting_workflow":false,"pp_workflow_action":"current","pp_status_selection":"publish","pp_force_visibility":null,"pp_subpost_visibility":null,"pp_inherited_force_visibility":null,"pp_inherited_subpost_visibility":null,"acf":[],"year_month":"2026-07","word_count":890,"total_views":"758","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Stefan Krumsdorf","author_nicename":"skrumsdorf","author_url":"https:\/\/churchtools.academy\/en\/author\/skrumsdorf\/"},"doc_category_info":[{"term_name":"OAuth","term_url":"https:\/\/churchtools.academy\/en\/help\/system-settings\/oauth-login-systemsettings\/"}],"doc_tag_info":[],"knowledge_base_info":[{"term_name":"System Settings","term_url":"https:\/\/churchtools.academy\/en\/help\/system-settings\/","term_slug":"system-settings"}],"knowledge_base_slug":["system-settings"],"_links":{"self":[{"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/docs\/45112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/comments?post=45112"}],"version-history":[{"count":3688,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/docs\/45112\/revisions"}],"predecessor-version":[{"id":70152,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/docs\/45112\/revisions\/70152"}],"wp:attachment":[{"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/media?parent=45112"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/doc_category?post=45112"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/doc_tag?post=45112"},{"taxonomy":"knowledge_base","embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/knowledge_base?post=45112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}