Issues

• [RFC 6749 Conformance] AuthorizationCodeGrant does not enforce code expiration at framework level

  authlib/authlib#939 · Filter by author LaVie88 opened on Oct 1, 2026
  1

• authlib.common.security.generate_token, at least when used for PKCE code verifiers, should follow RFC 7636 recommendations

  Feature

  authlib/authlib#935 · Filter by author calestyo opened on Sep 3, 2026

• support httpx.URL objects for urls

  Feature

  authlib/authlib#931 · Filter by author calestyo opened on Aug 27, 2026

• JSONDecodeError raised instead of a HTTP error

  Bug

  authlib/authlib#928 · Filter by author mtricht opened on Aug 26, 2026
  1

• Confirmation: CVE-2026-41479 + CVE-2026-44681 OAuth/OIDC redirect URI confusion reproduced (no action needed)

  authlib/authlib#918 · Filter by author plotarmordev opened on Aug 8, 2026

• Support Client ID Metadata Document?

  Feature

  authlib/authlib#900 · Filter by author snarfed opened on Jun 1, 2026
  1

• Type checking error: AsyncOAuth2Client has no attribute "get"

  Bug

  authlib/authlib#899 · Filter by author 0x1618 opened on May 29, 2026
  1

• Using Authlib in a Multi-Instance Setup

  Feature

  authlib/authlib#878 · Filter by author JannisZeller opened on Apr 17, 2026

• Support Identity Assertion JWT Authorization Grant (ID-JAG)

  Feature

  authlib/authlib#870 · Filter by author Akankshabhasin opened on Mar 9, 2026

• Support for oauth state management using signed JWTs

  Feature

  authlib/authlib#866 · Filter by author winwinashwin opened on Mar 1, 2026

• Allow custom expiration time for JWT client authentication

  role:resource_serverspec:rfc7523
  Feature

  authlib/authlib#857 · Filter by author markhobson opened on Feb 6, 2026

• Key management overhaul

  role:authorization_server
  Task

  authlib/authlib#856 · Filter by author azmeuk opened on Jan 27, 2026 · Version 1.7
  2

  

• rfc7523.JWTBearerTokenGenerator is obsolete

  break changerole:authorization_serverspec:rfc7523spec:rfc9068
  Task

  authlib/authlib#846 · Filter by author azmeuk opened on Dec 18, 2025

• length of sqla OAuth2TokenMixin tokens defined as too small

  Bug

  authlib/authlib#836 · Filter by author sistason opened on Oct 24, 2025
  2

• RFC9068 JWT access tokens cannot be used at the userinfo endoint

  role:authorization_server
  Bug

  authlib/authlib#831 · Filter by author azmeuk opened on Oct 3, 2025
  1

• Allow OAuth session to be reused across requests

  integration:httpxintegration:requests
  Feature

  authlib/authlib#822 · Filter by author markhobson opened on Sep 11, 2025 · Version 1.7

• RFC8693 - Support for Token Exchange

  Feature

  authlib/authlib#821 · Filter by author maia-iyer opened on Sep 10, 2025
  1

• JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)

  Feature

  authlib/authlib#820 · Filter by author azmeuk opened on Sep 6, 2025

• Add async OAuth client convenience methods

  role:client
  Feature

  authlib/authlib#819 · Filter by author markhobson opened on Sep 5, 2025
  2

• Add async Flask OAuth client

  integration:flaskrole:client
  Feature

  authlib/authlib#818 · Filter by author markhobson opened on Sep 5, 2025
  1

• OAuth 2.0 Form Post Response Mode

  role:authorization_server
  Feature

  authlib/authlib#816 · Filter by author azmeuk opened on Sep 4, 2025

• OAuth 2.0 Multiple Response Type

  role:authorization_server
  Feature

  authlib/authlib#815 · Filter by author azmeuk opened on Sep 4, 2025
  1

• Support for OIDC 3rd party initiated login

  Feature

  authlib/authlib#807 · Filter by author azmeuk opened on Aug 26, 2025

• Add environment variable support for server_metadata_url

  Feature

  authlib/authlib#797 · Filter by author kimminw00 opened on Aug 14, 2025

• Make it more feasible to manage multiple tokens

  role:client
  Feature

  authlib/authlib#796 · Filter by author rehevkor5 opened on Aug 12, 2025
  1