Parameter · Connections and Authentication / Authentication

oauth_validator_libraries

Lists libraries that may be called to validate OAuth v2 bearer tokens.

Default: '' (empty)
Type: string
Applies: Reload

In plain words

PostgreSQL 18 can log users in with OAuth 2.0 tokens from an identity provider (for example single sign-on). PostgreSQL does not check those tokens itself: a validator library does. This setting lists the allowed validator libraries.

Empty (the default) means OAuth logins are refused.

For DBAs and operators

New in PostgreSQL 18 together with the oauth method in pg_hba.conf:

host all all 0.0.0.0/0 oauth issuer="https://idp.example.com" scope="openid postgres" validator=my_validator

The client (libpq with oauth_issuer/oauth_client_id) obtains a bearer token from the issuer, for example with the device-authorization flow, and sends it in the SASL OAUTHBEARER exchange. The backend loads the validator module, which must confirm the token is valid and authorizes the requested role (optionally through a pg_ident.conf map or delegate_ident_mapping).

With exactly one library listed, it is used for all oauth HBA lines; with several, each line must name one with validator=.
No validator ships with PostgreSQL; you need a vendor or self-written module (C API, see "OAuth Validator Modules" in the docs).
issuer and scope are required on the HBA line; otherwise the line is rejected when pg_hba.conf is loaded.

Set it in postgresql.conf; a reload is enough. Treat validator libraries as security-critical code: they decide who gets in.

How to change it

Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().

See it in context

Client authentication

Related parameters

password_encryption authentication_timeout ssl

All Connections and Authentication parameters