OneDrive

Access the signed-in user’s OneDrive through Microsoft Graph using the global Graph and common OAuth endpoints.

Adapter type: onedrive. See Common configuration for mounting instructions.

Setup

Register an application in Microsoft Entra with the audience matching your account and record its Application (client) ID.
Create a client secret and save its Value, rather than its Secret ID.
Open the OneDrive authorization tool and register its exact Redirect URI as a Web callback.
Add delegated Graph permissions Files.ReadWrite.All and User.Read; request offline_access during authorization. Organization accounts may require administrator consent.
Authorize using your own app credentials and configure the resulting refresh_token with that same application ID and secret.

Configuration

Field	Type	Required	Default	Description
`client_id`	string	Yes	—	OAuth application client ID.
`client_secret`	password	Yes	—	Client secret for the same OAuth application.
`refresh_token`	password	Yes	—	Refresh token issued for this application and account.
`root`	string	No	`"/"`	Directory on the backend, separate from the mount path displayed in Foxel.
`enable_direct_download_307`	boolean	No	`false`	Allow HTTP 307 redirects to an upstream download URL; the client must be able to reach it.

Example

This is a config object. In the admin form, fill the corresponding fields rather than pasting the whole object. Replace credential placeholders with your own values.

json

{
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "refresh_token": "YOUR_REFRESH_TOKEN",
  "root": "/Documents/Foxel",
  "enable_direct_download_307": false
}

Behavior and limitations

root is a path inside the user’s drive, not a folder ID or share URL. Create the directory in OneDrive first.
No national-cloud endpoint, SharePoint site, or explicit Drive ID option is exposed.
In redirect mode, the client downloads from the Microsoft URL and needs network access to it.

Troubleshooting

redirect_uri_mismatch: the registered URI must exactly match the tool’s URI.
invalid_grant / invalid_client: check that the token belongs to the same app and the secret has not expired; reauthorize if needed.
Directory missing: verify / first, then check each path segment; do not use a browser URL as the root.

References

External documentation provides service and authorization context. Use this page and the current Foxel adapter for configuration fields and limitations.