From 32eaf99a24c55a246d7e8633db0338307f60ca83 Mon Sep 17 00:00:00 2001
From: Ralf Grubenmann <ralf.grubenmann@sdsc.ethz.ch>
Date: Thu, 22 Oct 2026 09:22:07 +0200
Subject: [PATCH] fix: require offline_access scope in openwebui to get refresh
 tokens

---
 templates/openwebui/deployment.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/templates/openwebui/deployment.yaml b/templates/openwebui/deployment.yaml
index 30faa01..e583e18 100644
--- a/templates/openwebui/deployment.yaml
+++ b/templates/openwebui/deployment.yaml
@@ -78,6 +78,8 @@ spec:
               value: "true"
             - name: ENABLE_OAUTH_ID_TOKEN_COOKIE
               value: "false"
+            - name: OAUTH_SCOPES
+              value: "openid email profile offline_access"
             - name: CORS_ALLOW_ORIGIN
               value: "https://openwebui.{{ .Values.envoy.baseDomain }}"
           startupProbe: