https://github.com/doorkeeper-gem/doorkeeper

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.
https://github.com/doorkeeper-gem/doorkeeper

Keywords

authentication authorization doorkeeper grape identity oauth oauth2 oauth2-provider oauth2-server ruby-on-rails

Keywords from Contributors

activerecord activejob mvc rubygems ruby-gem crash-reporting rack sidekiq background-jobs sinatra

Last synced: about 7 hours ago
JSON representation

Repository metadata

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.

Host: GitHub
URL: https://github.com/doorkeeper-gem/doorkeeper
Owner: doorkeeper-gem
License: mit
Created: 2011-11-18T13:02:01.000Z (over 14 years ago)
Default Branch: main
Last Pushed: 2026-08-08T10:56:00.000Z (8 days ago)
Last Synced: 2026-08-09T11:24:32.276Z (7 days ago)
Topics: authentication, authorization, doorkeeper, grape, identity, oauth, oauth2, oauth2-provider, oauth2-server, ruby-on-rails
Language: Ruby
Homepage: https://doorkeeper.gitbook.io/guides/
Size: 4.7 MB
Stars: 5,516
Watchers: 97
Forks: 1,079
Open Issues: 17
Releases: 76
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- Funding: .github/FUNDING.yml
- License: MIT-LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
- Agents: AGENTS.md

Doorkeeper — awesome OAuth 2 provider for your Rails / Grape app.

Doorkeeper is a gem (Rails engine) that makes it easy to introduce OAuth 2 provider
functionality to your Ruby on Rails or Grape application.

Supported features:

The OAuth 2.0 Authorization Framework
OAuth 2.0 Token Revocation
OAuth 2.0 Token Introspection
OAuth 2.0 Threat Model and Security Considerations
OAuth 2.0 for Native Apps
Proof Key for Code Exchange by OAuth Public Clients
OAuth 2.0 Authorization Server Issuer Identification — opt-in by setting issuer; adds the iss parameter to authorization redirects returned to the client
Resource Indicators for OAuth 2.0

Documentation
Installation
- Ruby on Rails
- Grape
ORMs
Extensions
Resource Indicators
Custom Grant Flows
Example Applications
Sponsors
Development
Contributing
Contributors
License

Documentation

This documentation is valid for main branch. Please check the documentation for the version of doorkeeper you are using in:
https://github.com/doorkeeper-gem/doorkeeper/releases.

Additionally, other resources can be found on:

Guides with how-to get started and configuration documentation
See the Wiki for articles on how to integrate with other solutions
Screencast from railscasts.com: #353
OAuth with
Doorkeeper
See upgrade guides
For general questions, please post on Stack Overflow
See SECURITY.md for this project's security disclose
policy

Installation

Installation depends on the framework you're using. The first step is to add the following to your Gemfile:

gem 'doorkeeper'

And run bundle install. After this, check out the guide related to the framework you're using.

Ruby on Rails

Doorkeeper currently supports Ruby on Rails >= 5.0. See the guide here.

Grape

Guide for integration with Grape framework can be found here.

ORMs

Doorkeeper supports Active Record by default, but can be configured to work with the following ORMs:

ORM	Support via
Active Record	by default
MongoDB	doorkeeper-gem/doorkeeper-mongodb
Sequel	nbulaj/doorkeeper-sequel
Couchbase	acaprojects/doorkeeper-couchbase
RethinkDB	aca-labs/doorkeeper-rethinkdb

Extensions

Extensions that are not included by default and can be installed separately.

	Link
OpenID Connect extension	doorkeeper-gem/doorkeeper-openid_connect
JWT Token support	doorkeeper-gem/doorkeeper-jwt
Assertion grant extension	doorkeeper-gem/doorkeeper-grants_assertion
I18n translations	doorkeeper-gem/doorkeeper-i18n
CIBA - Client Initiated Backchannel Authentication Flow extension	doorkeeper-ciba
Device Authorization Grant	doorkeeper-device_authorization_grant

Resource Indicators

Doorkeeper supports Resource Indicators for OAuth 2.0 (RFC 8707), allowing clients to signal which protected resource(s) they intend to access. Tokens are then audience-restricted to those resources.

Setup

Run the generator to add the required resource column:

rails generate doorkeeper:resource_indicators
rails db:migrate

Configure a validator in your initializer:

# config/initializers/doorkeeper.rb
Doorkeeper.configure do
  resource_indicator_validator ->(resource_indicators, client) {
    allowed = %w[https://api.example.com/ https://calendar.example.com/]
    resource_indicators.all? { |r| allowed.include?(r) }
  }
end

The callable receives an array of resource URIs and the OAuth client. Return true to accept or false to reject with invalid_target.

Behavior

Resource URIs must be absolute and must not contain a fragment component.
Resource indicators are stored on grants and tokens.
Token and refresh requests enforce subset restrictions against the original grant.
Token introspection responses include aud when resource indicators are present.
Grants issued with resource indicators retain their audience restriction even if the validator is later removed from configuration.

Multiple resources

RFC 8707 uses repeated query parameters (?resource=…&resource=…) for multiple values, but Rack collapses repeated keys to the last value. Clients must use the Rails bracket syntax for multiple resource indicators:

?resource[]=https://api.example.com/&resource[]=https://calendar.example.com/

A single resource=… works as-is.

Custom Grant Flows

Besides the built-in OAuth 2 flows, Doorkeeper can recognize and process any custom grant type through its grant flow registry — including grant types whose names are URNs or URIs, such as the SAML 2.0 bearer assertion grant defined by RFC 7522.

A grant flow bundles a matcher for the grant_type parameter with a strategy class that processes the token request. Register it before Doorkeeper.configure and enable it by adding its registered name to grant_flows:

# config/initializers/doorkeeper.rb
Doorkeeper::GrantFlow.register(
  :saml2_bearer,
  grant_type_matches: "urn:ietf:params:oauth:grant-type:saml2-bearer",
  grant_type_strategy: SamlBearer::Strategy,
)

Doorkeeper.configure do
  grant_flows %w[authorization_code saml2_bearer]
  # ...
end

Note that grant_flows lists the registered flow name (saml2_bearer), while grant_type_matches — a String or a Regexp — is what the request's grant_type parameter is matched against.

The strategy class receives the authorization server as server and builds the request object handling the grant:

module SamlBearer
  class Strategy < Doorkeeper::Request::Strategy
    delegate :client, :parameters, to: :server

    def request
      @request ||= TokenRequest.new(Doorkeeper.config, client, parameters)
    end
  end
end

The request object validates the grant and issues the token. Subclassing Doorkeeper::OAuth::BaseRequest provides the response handling, scope calculation and token creation, so only the grant-specific parts remain (per RFC 7522 §2.1 the assertion parameter carries a single SAML assertion, base64url-encoded without padding):

module SamlBearer
  class TokenRequest < Doorkeeper::OAuth::BaseRequest
    validate :client, error: Doorkeeper::Errors::InvalidClient
    validate :client_supports_grant_flow, error: Doorkeeper::Errors::UnauthorizedClient
    validate :assertion, error: Doorkeeper::Errors::InvalidGrant
    validate :scopes, error: Doorkeeper::Errors::InvalidScope

    attr_reader :client, :parameters, :access_token

    def initialize(server, client, parameters = {})
      @server          = server
      @client          = client
      @parameters      = parameters
      @original_scopes = parameters[:scope]
      @grant_type      = "urn:ietf:params:oauth:grant-type:saml2-bearer"
    end

    private

    def before_successful_response
      find_or_create_access_token(client, resource_owner, scopes, {}, server)
      super
    end

    def assertion
      # Decode and verify the SAML assertion — signature, audience, validity
      # window, etc. — e.g. with the ruby-saml gem. Skipping verification
      # turns the endpoint into a token vending machine for anyone.
      @assertion ||= decode_and_verify_saml(parameters[:assertion])
    end

    def resource_owner
      # Map the assertion's subject to a resource owner.
      @resource_owner ||= User.find_by(email: assertion.name_id)
    end

    def validate_client
      client.present?
    end

    def validate_client_supports_grant_flow
      Doorkeeper.config.allow_grant_flow_for_client?(grant_type, client&.application)
    end

    def validate_assertion
      assertion.present? && resource_owner.present?
    end

    def validate_scopes
      return true if scopes.blank?

      Doorkeeper::OAuth::Helpers::ScopeChecker.valid?(
        scope_str: scopes.to_s,
        server_scopes: server.scopes,
        app_scopes: client&.scopes,
        grant_type: grant_type,
      )
    end
  end
end

The client_supports_grant_flow validation keeps the custom grant subject to the allow_grant_flow_for_client configuration option (per-client grant restrictions), just like the built-in flows.

Flows can also handle custom response_type values on the authorization endpoint via the response_type_matches / response_type_strategy options — see the built-in registrations in lib/doorkeeper/grant_flow.rb for reference. An extension can also group several flows under one configuration name with Doorkeeper::GrantFlow.register_alias (e.g. the OpenID Connect extension registers implicit_oidc to expand to multiple response types).

Example Applications

These applications show how Doorkeeper works and how to integrate with it. Start with the oAuth2 server and use the clients to connect with the server.

Application	Link
OAuth2 Server with Doorkeeper	doorkeeper-gem/doorkeeper-provider-app
Sinatra Client connected to Provider App	doorkeeper-gem/doorkeeper-sinatra-client
Devise + Omniauth Client	doorkeeper-gem/doorkeeper-devise-client

You may want to create a client application to
test the integration. Check out these client
examples
in our wiki or follow this tutorial
here.

Development

To run the local engine server:

bundle install
bundle exec rake doorkeeper:server

By default, it uses the latest Rails version with ActiveRecord. To run the
tests with a specific Rails version:

BUNDLE_GEMFILE=gemfiles/rails_6_0.gemfile bundle exec rake

You can also experiment with the changes using bin/console. It uses in-memory SQLite database and default
Doorkeeper config, but you can reestablish connection or reconfigure the gem if you need.

Contributing

Want to contribute and don't know where to start? Check out features we're
missing,
create example
apps,
integrate the gem with your app and let us know!

Also, check out our contributing guidelines page.

Contributors

Thanks to all our awesome
contributors!

License

MIT License. Created in Applicake. Maintained by the community.

Owner metadata

Name: doorkeeper gem
Login: doorkeeper-gem
Email:
Kind: organization
Description: Doorkeeper is an OAuth 2 provider gem for Rails and Ruby frameworks
Website:
Location:
Twitter:
Company:
Icon url: https://avatars.githubusercontent.com/u/7275750?v=4
Repositories: 10
Last ynced at: 2024-03-25T19:56:21.955Z
Profile URL: https://github.com/doorkeeper-gem

GitHub Events

Total

Release event: 2
Delete event: 9
Pull request event: 49
Fork event: 22
Issues event: 16
Watch event: 145
Issue comment event: 121
Push event: 72
Pull request review event: 118
Pull request review comment event: 96
Create event: 11

Last Year

Delete event: 5
Pull request event: 12
Fork event: 5
Issues event: 2
Watch event: 30
Issue comment event: 30
Push event: 51
Pull request review comment event: 14
Pull request review event: 15
Create event: 6

Committers metadata

Last synced: about 8 hours ago

Total Commits: 2,072
Total Committers: 337
Avg Commits per committer: 6.148
Development Distribution Score (DDS): 0.808

Commits in past year: 196
Committers in past year: 13
Avg Commits per committer in past year: 15.077
Development Distribution Score (DDS) in past year: 0.393

Name	Email	Commits
Nikita Bulai	b**a@g**m	397
Felipe Elias Philipp	f**s@g**m	383
Tute Costa	t**a@g**m	213
Kenta Ishizaki	k**i@5**p	119
Piotr Jakubowski	p**j@g**m	71
jasl	j**7@h**m	57
Jon Moss	me@j****e	46
Peter M. Goldstein	p**n@g**m	27
Linh Dang	d**k@g**m	26
dependabot[bot]	4****]	23
Jaime Iniesta	j**a@g**m	18
Simon Bonnard	s**d@g**m	16
copilot-swe-agent[bot]	1****t	16
Anthony Kirwan	a**n@g**m	15
Martin Lagrange	m**n@i**m	15
Peter Goldstein	p**n@y**m	15
Carol Nichols	c**s@g**m	14
Stas SUȘCOV	s**s@n**o	13
JeremyC-za	j**2@g**m	13
Kenn Ejima	k**a@g**m	13
Ransom Briggs	r**s@e**m	13
camero2734	4****4	11
Emelia Smith	T****m	10
Kristine Robison	k**s@t**m	10
dependabot-preview[bot]	2****]	9
Rishabh Sairawat	r**1@g**m	9
Justin Bull	j**n@w**m	9
Justin Bull	me@j****a	7
carvil	c**a@g**m	7
Ryan Schlesinger	r**n@r**m	7
and 307 more...

Committer domains:

Issue and Pull Request metadata

Last synced: 1 day ago

Total issues: 149
Total pull requests: 266
Average time to close issues: 12 months
Average time to close pull requests: about 1 month
Total issue authors: 110
Total pull request authors: 67
Average comments per issue: 4.43
Average comments per pull request: 2.26
Merged pull request: 194
Bot issues: 1
Bot pull requests: 28

Past year issues: 26
Past year pull requests: 103
Past year average time to close issues: about 1 month
Past year average time to close pull requests: 5 days
Past year issue authors: 14
Past year pull request authors: 15
Past year average comments per issue: 2.62
Past year average comments per pull request: 2.35
Past year merged pull request: 79
Past year bot issues: 0
Past year bot pull requests: 7

More stats: https://issues.ecosyste.ms/repositories/lookup?url=https://github.com/doorkeeper-gem/doorkeeper

Top Issue Authors

ThisIsMissEm (16)
ransombriggs (7)
55728 (6)
nov (3)
kmayer (3)
matthewheath (2)
brent-cybrid (2)
verenion (2)
j-seixas (2)
hickford (2)
PhilippeChab (2)
leoarnold (2)
mroach (2)
stevetsanders (2)
jensljungblad (1)

Top Pull Request Authors

55728 (70)
nbulaj (35)
dependabot[bot] (28)
ThisIsMissEm (15)
ransombriggs (9)
Copilot (6)
naitoh (6)
stanhu (6)
JeremyC-za (5)
gkemmey (4)
sato11 (4)
lurz (4)
kmayer (4)
ydah (3)
filipesperandio (2)

Top Issue Labels

wontfix (16)
pinned (9)
feature request (8)
enhancement (7)
RFC (6)
bug? (5)
bug (5)
question/discussion (4)
help wanted (2)
security (2)
ruby (1)
spec (1)
refactor (1)
dependencies (1)
docs (1)

Top Pull Request Labels

dependencies (28)
ruby (17)
github_actions (11)
wontfix (6)
WIP (2)
pinned (2)
refactor (1)
bug (1)
enhancement (1)

Package metadata

Total packages: 14
Total downloads:
- rubygems: 224,215,281 total
Total docker downloads: 1,163,654,018
Total dependent packages: 41 (may contain duplicates)
Total dependent repositories: 5,404 (may contain duplicates)
Total versions: 370
Total maintainers: 5
Total advisories: 14

gem.coop: doorkeeper

Doorkeeper is an OAuth 2 provider for Rails and Grape.

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Documentation: http://www.rubydoc.info/gems/doorkeeper/
Licenses: MIT
Latest release: 5.9.6 (published 5 days ago)
Last Synced: 2026-08-15T09:32:22.590Z (1 day ago)
Versions: 131
Dependent Packages: 0
Dependent Repositories: 0
Downloads: 112,099,496 Total
Docker Downloads: 581,827,009
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 0.083%
- Downloads: 0.248%
Maintainers (5)
Funding:
- https://opencollective.com/doorkeeper-gem
Advisories:

rubygems.org: doorkeeper

Doorkeeper is an OAuth 2 provider for Rails and Grape.

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Documentation: http://www.rubydoc.info/gems/doorkeeper/
Licenses: MIT
Latest release: 5.9.6 (published 5 days ago)
Last Synced: 2026-08-16T09:03:56.267Z (about 8 hours ago)
Versions: 131
Dependent Packages: 41
Dependent Repositories: 5,403
Downloads: 112,115,785 Total
Docker Downloads: 581,827,009
Rankings:
- Docker downloads count: 0.188%
- Stargazers count: 0.238%
- Downloads: 0.323%
- Average: 0.375%
- Dependent repos count: 0.432%
- Forks count: 0.434%
- Dependent packages count: 0.632%
Maintainers (5)
Funding:
- https://opencollective.com/doorkeeper-gem
Advisories:

proxy.golang.org: github.com/doorkeeper-gem/doorkeeper

Homepage:
Documentation: https://pkg.go.dev/github.com/doorkeeper-gem/doorkeeper#section-documentation
Licenses: mit
Latest release: v5.9.6+incompatible (published 5 days ago)
Last Synced: 2026-08-14T11:39:00.897Z (2 days ago)
Versions: 97
Dependent Packages: 0
Dependent Repositories: 1
Rankings:
- Forks count: 0.823%
- Stargazers count: 0.93%
- Average: 3.75%
- Dependent repos count: 4.794%
- Dependent packages count: 8.453%

pkgsrc-netbsd-x86_64-10.1-all: www/ruby-doorkeeper

OAuth 2 provider for Rails and Grape

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Documentation: https://pkgsrc.se/www/ruby-doorkeeper
Licenses: mit
Latest release: 5.8.2 (published 4 months ago)
Last Synced: 2026-05-27T10:51:42.069Z (3 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

ubuntu-24.04: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Licenses: mit
Latest release: 5.6.6-2 (published 6 months ago)
Last Synced: 2026-03-06T16:47:12.499Z (5 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:

ubuntu-22.04: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Licenses: mit
Latest release: 5.5.0-2 (published 6 months ago)
Last Synced: 2026-08-08T22:04:22.457Z (8 days ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

debian-10: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Documentation: https://packages.debian.org/buster/ruby-doorkeeper
Licenses: mit
Latest release: 4.4.2-1 (published 6 months ago)
Last Synced: 2026-03-13T20:01:52.875Z (5 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

debian-11: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Documentation: https://packages.debian.org/bullseye/ruby-doorkeeper
Licenses: mit
Latest release: 5.3.0-2 (published 6 months ago)
Last Synced: 2026-08-01T00:04:55.146Z (16 days ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

debian-13: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Documentation: https://packages.debian.org/trixie/ruby-doorkeeper
Licenses: mit
Latest release: 5.6.6-2 (published 6 months ago)
Last Synced: 2026-07-29T05:01:13.450Z (18 days ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

ubuntu-24.10: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Licenses: mit
Latest release: 5.6.6-2 (published 6 months ago)
Last Synced: 2026-03-09T17:04:52.233Z (5 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

ubuntu-23.04: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Licenses: mit
Latest release: 5.5.0-2 (published 6 months ago)
Last Synced: 2026-03-11T14:11:46.900Z (5 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

debian-12: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Documentation: https://packages.debian.org/bookworm/ruby-doorkeeper
Licenses: mit
Latest release: 5.5.0-2+deb12u1 (published 6 months ago)
Last Synced: 2026-03-13T23:42:58.016Z (5 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

ubuntu-23.10: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Licenses: mit
Latest release: 5.6.6-2 (published 6 months ago)
Last Synced: 2026-03-13T19:23:27.564Z (5 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

ubuntu-20.04: ruby-doorkeeper

Homepage: https://github.com/doorkeeper-gem/doorkeeper
Licenses: mit
Latest release: 5.0.2-2 (published 6 months ago)
Last Synced: 2026-03-13T20:21:54.482Z (5 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

Dependencies

.github/workflows/check_orm_changes.yml actions

dacbd/create-issue-action main composite
lots0logs/gh-action-get-changed-files 2.1.4 composite

.github/workflows/ci.yml actions

actions/checkout v3 composite
ruby/setup-ruby v1 composite

Dockerfile docker

ruby 2.6.5-alpine build

Gemfile rubygems

activerecord-jdbcsqlite3-adapter >= 0
bcrypt ~> 3.1
rails >= 6.0, < 7.1
rspec-core >= 0
rspec-expectations >= 0
rspec-mocks >= 0
rspec-rails ~> 6.0
rspec-support >= 0
rubocop ~> 1.4
rubocop-performance >= 0
rubocop-rails >= 0
rubocop-rspec >= 0
sprockets-rails >= 0
timecop >= 0

doorkeeper.gemspec rubygems

appraisal >= 0 development
capybara >= 0 development
coveralls_reborn >= 0 development
database_cleaner ~> 2.0 development
factory_bot ~> 6.0 development
generator_spec ~> 0.9.3 development
grape >= 0 development
rake >= 11.3.0 development
rspec-rails >= 0 development
timecop >= 0 development
railties >= 5

Score: 35.48960819576433