[GH-ISSUE #5949] [bug]: OAuth 2.0 token is synced across team members in Team workspaces #2337

New issue

Open

opened 2026-03-17 00:00:32 +03:00 by kerem · 1 comment

kerem commented

2026-03-17 00:00:32 +03:00

Owner

Originally created by @Laeborg on GitHub (Mar 5, 2026).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5949

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Platform

Web App

Browser

Firefox

Operating System

Linux

Bug Description

What happened

When using OAuth 2.0 authorization in a Team workspace — whether configured on a collection or an individual request — the token itself is synchronized across all team members. This means that when one developer generates a token, it overwrites or replaces the token for all other developers in the workspace.

What I expected

Only the OAuth 2.0 configuration (endpoints, client ID, scopes, grant type, etc.) should be synchronized across team members. The token itself should remain personal and local to each user, allowing every developer to authenticate with their own credentials independently.

This is consistent with how Postman handles OAuth 2.0 in shared workspaces.

Steps to reproduce

Create or open a Team workspace.
Configure OAuth 2.0 authorization on a collection (e.g. with Authorization Code grant type).
Have one team member generate a token via Generate Token.
Observe that the token is now visible and active for all other team members in the workspace.

Additional context

The issue affects both collection-level and request-level OAuth 2.0 authorization.

OAuth 2.0 configuration fields (endpoints, client ID, scopes, etc.) are expected to sync — only the token should be excluded.

This is a privacy/security concern, as tokens are personal and tied to individual user sessions.

Deployment Type

Self-hosted (on-prem deployment)

Version

2026.2.0

Originally created by @Laeborg on GitHub (Mar 5, 2026). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5949 ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Platform Web App ### Browser Firefox ### Operating System Linux ### Bug Description ## What happened When using OAuth 2.0 authorization in a Team workspace — whether configured on a collection or an individual request — the token itself is synchronized across all team members. This means that when one developer generates a token, it overwrites or replaces the token for all other developers in the workspace. ## What I expected Only the OAuth 2.0 configuration (endpoints, client ID, scopes, grant type, etc.) should be synchronized across team members. The token itself should remain personal and local to each user, allowing every developer to authenticate with their own credentials independently. This is consistent with how Postman handles OAuth 2.0 in shared workspaces. ## Steps to reproduce 1. Create or open a Team workspace. 2. Configure OAuth 2.0 authorization on a collection (e.g. with Authorization Code grant type). 3. Have one team member generate a token via Generate Token. 4. Observe that the token is now visible and active for all other team members in the workspace. ## Additional context The issue affects both collection-level and request-level OAuth 2.0 authorization. OAuth 2.0 configuration fields (endpoints, client ID, scopes, etc.) are expected to sync — only the token should be excluded. This is a privacy/security concern, as tokens are personal and tied to individual user sessions. ### Deployment Type Self-hosted (on-prem deployment) ### Version 2026.2.0

kerem added the

bug

need testing

labels

2026-03-17 00:00:32 +03:00

kerem commented

2026-03-17 00:00:43 +03:00

Author

Owner

@Desel72 commented on GitHub (Mar 5, 2026):

Hi @jamesgeorge007, I'd love to work on this. Could you please assign this to me.

@Desel72 commented on GitHub (Mar 5, 2026): Hi @jamesgeorge007, I'd love to work on this. Could you please assign this to me.