coder · BobbyHo · Sep 11, 2026 · Sep 11, 2026 · Sep 11, 2026
diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden
@@ -693,6 +693,13 @@ OAUTH2 / GITHUB OPTIONS:
           Base URL of a GitHub Enterprise deployment to use for Login with
           GitHub.
 
+OAUTH2 / PROVIDER OPTIONS: 
+      --oauth2-provider-enable bool, $CODER_OAUTH2_PROVIDER_ENABLE (default: false)
+          Enable the OAuth 2.1 authorization server, which lets external
+          applications (such as MCP clients) obtain tokens for Coder on behalf
+          of users. Disabled by default. When disabled, the OAuth2 endpoints and
+          discovery documents return 404.
+
 OIDC OPTIONS: 
       --oidc-group-auto-create bool, $CODER_OIDC_GROUP_AUTO_CREATE (default: false)
           Automatically creates missing groups from a user's groups claim.

diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden
@@ -321,6 +321,12 @@ oauth2:
     # Base URL of a GitHub Enterprise deployment to use for Login with GitHub.
     # (default: <unset>, type: string)
     enterpriseBaseURL: ""
+  provider:
+    # Enable the OAuth 2.1 authorization server, which lets external applications
+    # (such as MCP clients) obtain tokens for Coder on behalf of users. Disabled by
+    # default. When disabled, the OAuth2 endpoints and discovery documents return 404.
+    # (default: false, type: bool)
+    enable: false
 oidc:
   # Whether new users can sign up with OIDC.
   # (default: true, type: bool)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -773,6 +773,7 @@ func New(options *Options) *API {
 		DeploymentID:          api.DeploymentID,
 		WebPushPublicKey:      api.WebpushDispatcher.PublicKey(),
 		Telemetry:             api.Telemetry.Enabled(),
+		OAuth2Provider:        api.DeploymentValues.OAuth2.Provider.Enable.Value(),
 	}
 	api.SiteHandler, err = site.New(&site.Options{
 		CacheDir:                  siteCacheDir,

diff --git a/coderd/coderd_test.go b/coderd/coderd_test.go
@@ -56,6 +56,21 @@ func TestBuildInfo(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, buildinfo.ExternalURL(), buildInfo.ExternalURL, "external URL")
 	require.Equal(t, buildinfo.Version(), buildInfo.Version, "version")
+	require.True(t, buildInfo.OAuth2Provider, "coderdtest enables the OAuth2 provider by default")
+}
+
+func TestBuildInfoOAuth2ProviderDisabled(t *testing.T) {
+	t.Parallel()
+	client := coderdtest.New(t, &coderdtest.Options{
+		DeploymentValues: coderdtest.DeploymentValues(t, func(dv *codersdk.DeploymentValues) {
+			dv.OAuth2.Provider.Enable = false
+		}),
+	})
+
+	ctx := testutil.Context(t, testutil.WaitLong)
+	buildInfo, err := client.BuildInfo(ctx)
+	require.NoError(t, err)
+	require.False(t, buildInfo.OAuth2Provider)
 }
 
 func TestDERP(t *testing.T) {

diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
@@ -1861,6 +1861,9 @@ func DeploymentValues(t testing.TB, mut ...func(*codersdk.DeploymentValues)) *co
 	opts := cfg.Options()
 	err := opts.SetDefaults()
 	require.NoError(t, err)
+	// The OAuth2 provider is off by default in production. Tests turn it on
+	// so OAuth2 routes are reachable without extra setup.
+	cfg.OAuth2.Provider.Enable = true
 	for _, fn := range mut {
 		fn(cfg)
 	}

diff --git a/codersdk/deployment.go b/codersdk/deployment.go
@@ -976,7 +976,17 @@ type PprofConfig struct {
 }
 
 type OAuth2Config struct {
-	Github OAuth2GithubConfig `json:"github" typescript:",notnull"`
+	Github   OAuth2GithubConfig   `json:"github" typescript:",notnull"`
+	Provider OAuth2ProviderConfig `json:"provider" typescript:",notnull"`
+}
+
+// OAuth2ProviderConfig configures Coder's own OAuth 2.1 authorization server.
+// This is separate from the GitHub login integration. It is also distinct
+// from OAuth2ProviderSettings: this struct decides whether the server is on
+// at all, while OAuth2ProviderSettings holds runtime behavior such as
+// dynamic client registration that admins change while it runs.
+type OAuth2ProviderConfig struct {
+	Enable serpent.Bool `json:"enable" typescript:",notnull"`
 }
 
 type OAuth2GithubConfig struct {
@@ -1595,14 +1605,19 @@ communicating directly.`,
 		}
 		deploymentGroupOAuth2 = serpent.Group{
 			Name:        "OAuth2",
-			Description: `Configure login and user-provisioning with GitHub via oAuth2.`,
+			Description: `Configure OAuth2: GitHub login and user-provisioning, and Coder's own OAuth 2.1 authorization server.`,
 			YAML:        "oauth2",
 		}
 		deploymentGroupOAuth2GitHub = serpent.Group{
 			Parent: &deploymentGroupOAuth2,
 			Name:   "GitHub",
 			YAML:   "github",
 		}
+		deploymentGroupOAuth2Provider = serpent.Group{
+			Parent: &deploymentGroupOAuth2,
+			Name:   "Provider",
+			YAML:   "provider",
+		}
 		deploymentGroupOIDC = serpent.Group{
 			Name: "OIDC",
 			YAML: "oidc",
@@ -2696,6 +2711,16 @@ communicating directly.`,
 			Group:       &deploymentGroupOAuth2GitHub,
 			YAML:        "enterpriseBaseURL",
 		},
+		{
+			Name:        "OAuth2 Provider Enable",
+			Description: "Enable the OAuth 2.1 authorization server, which lets external applications (such as MCP clients) obtain tokens for Coder on behalf of users. Disabled by default. When disabled, the OAuth2 endpoints and discovery documents return 404.",
+			Flag:        "oauth2-provider-enable",
+			Env:         "CODER_OAUTH2_PROVIDER_ENABLE",
+			Value:       &c.OAuth2.Provider.Enable,
+			Group:       &deploymentGroupOAuth2Provider,
+			YAML:        "enable",
+			Default:     "false",
+		},
 		// OIDC settings.
 		{
 			Name:        "OIDC Allow Signups",
@@ -5104,6 +5129,9 @@ type BuildInfoResponse struct {
 	DashboardURL string `json:"dashboard_url"`
 	// Telemetry is a boolean that indicates whether telemetry is enabled.
 	Telemetry bool `json:"telemetry"`
+	// OAuth2Provider reports whether the OAuth 2.1 authorization server is
+	// enabled. The dashboard uses it to show or hide OAuth2 navigation.
+	OAuth2Provider bool `json:"oauth2_provider"`
 
 	WorkspaceProxy bool `json:"workspace_proxy"`
 

diff --git a/docs/admin/setup/configuration-reference.md b/docs/admin/setup/configuration-reference.md
@@ -1308,7 +1308,7 @@ The endpoint to which to send webhooks.
 
 ## OAuth2
 
-Configure login and user-provisioning with GitHub via oAuth2.
+Configure OAuth2: GitHub login and user-provisioning, and Coder's own OAuth 2.1 authorization server.
 
 ### GitHub
 
@@ -1385,6 +1385,17 @@ Base URL of a GitHub Enterprise deployment to use for Login with GitHub.
 - CLI flag: [`--oauth2-github-enterprise-base-url`](../../reference/cli/server.md#--oauth2-github-enterprise-base-url)
 - YAML key: `oauth2.github.enterpriseBaseURL`
 
+### Provider
+
+#### Enable
+
+Enable the OAuth 2.1 authorization server, which lets external applications (such as MCP clients) obtain tokens for Coder on behalf of users. Disabled by default. When disabled, the OAuth2 endpoints and discovery documents return 404.
+
+- Environment variable: `CODER_OAUTH2_PROVIDER_ENABLE`
+- CLI flag: [`--oauth2-provider-enable`](../../reference/cli/server.md#--oauth2-provider-enable)
+- YAML key: `oauth2.provider.enable`
+- Default value: `false`
+
 ## OIDC
 
 ### Enable OIDC group auto create

diff --git a/docs/reference/api/general.md b/docs/reference/api/general.md
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
diff --git a/docs/reference/cli/server.md b/docs/reference/cli/server.md
diff --git a/enterprise/cli/testdata/coder_server_--help.golden b/enterprise/cli/testdata/coder_server_--help.golden
@@ -694,6 +694,13 @@ OAUTH2 / GITHUB OPTIONS:
           Base URL of a GitHub Enterprise deployment to use for Login with
           GitHub.
 
+OAUTH2 / PROVIDER OPTIONS: 
+      --oauth2-provider-enable bool, $CODER_OAUTH2_PROVIDER_ENABLE (default: false)
+          Enable the OAuth 2.1 authorization server, which lets external
+          applications (such as MCP clients) obtain tokens for Coder on behalf
+          of users. Disabled by default. When disabled, the OAuth2 endpoints and
+          discovery documents return 404.
+
 OIDC OPTIONS: 
       --oidc-group-auto-create bool, $CODER_OIDC_GROUP_AUTO_CREATE (default: false)
           Automatically creates missing groups from a user's groups claim.