All pull requests

Pull requests

• Fix empty signatures validation in JWS JSON deserialization

  #938·loporto opened Oct 1, 2026·

  ·
  1

• Generate PKCE code_verifier per RFC 7636 charset

  #937·pranjalm37 opened Sep 18, 2026·

  ·
  1

• update token when fetching

  #936·calestyo opened Sep 5, 2026·

  ·

• Accept httpx URL objects on OAuth client requests

  #934·gyanu2507 opened Aug 30, 2026·

  ·
  1

  7

• OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses

  #929·juneja-varun opened Aug 26, 2026·

  ·
  1

  2

• feat(oauth2): support form_post response mode on the authorization code and implicit grants

  #927·ChrisJr404 opened Aug 25, 2026·

  ·
  1

  1

• Return an empty list for an empty query string

  #926·RavSinghChandan opened Aug 24, 2026·

  ·

• feat: let ResourceProtector take a token_validator in __init__

  #925·pryzmatical opened Aug 22, 2026·

  ·
  1

  1

• AsyncOpenIDMixin.parse_id_token: return None when id_token is absent, matching the sync client

  #924·ckarnell opened Aug 17, 2026·

  ·

• Address Issue#735 - Initiating User Registration via OpenID Connect 1.0

  #907·cybersreejith opened Jul 4, 2026·

  ·
  1

  1

• Search for access token in body of userinfo requests #756

  #905·frohrlich opened Jun 19, 2026Contributor·6 tasks·

  ·
  1

• docs: add i18n wrappers in conf.py and templates

  #901·hwhsu1231 opened Jun 4, 2026·6 tasks done·

  ·

• feat: add token_endpoint_verify for custom CA on token requests

  #896·liudonggalaxy opened May 19, 2026Contributor·5 of 6 tasks·

  ·

• feat: auto-fetch token for client_credentials grant in OAuth2Session/OAuth2Client

  #895·liudonggalaxy opened May 18, 2026Contributor·5 of 6 tasks·

  ·
  1

• feat: add should_handle hook for JWT client auth algorithm routing

  #894·liudonggalaxy opened May 15, 2026Contributor·5 of 6 tasks·

  ·

• feat: fallback to trying all JWKS keys when kid does not match

  #893·liudonggalaxy opened May 15, 2026Contributor·5 of 6 tasks·

  ·
  2

• feat: Include issued_at and expires_at in token response, respect server timestamps on client

  #892·liudonggalaxy opened May 15, 2026Contributor·5 of 6 tasks·

  ·
  1

• feat: Forward extra kwargs (expires_in, issued_at) through ClientSecretJWT and PrivateKeyJWT

  #890·liudonggalaxy opened May 15, 2026Contributor·5 of 6 tasks·

  ·

• feat: Auto-propagate kid and alg from JWK to JWT header in RFC 7523 assertion signing

  #889·liudonggalaxy opened May 14, 2026Contributor·5 of 6 tasks·

  ·
  4

• OpenID Connect Back-Channel Logout

  role:authorization_serverspec:oidc-backchannel
  #874·azmeuk opened Mar 25, 2026Member·6 tasks done·

  ·
  1

  2

• feat: add dynamic module loading for client imports

  #871·GunniBusch opened Mar 10, 2026·2 of 6 tasks·

  ·
  1

• RFC-9126: PAR

  #814·zachswasey opened Sep 1, 2025·1 of 2 tasks·

  ·
  23

• RFC-9449: DPoP

  #808·zachswasey opened Aug 27, 2025·5 of 8 tasks·

  ·
  17

• Add support for RFC9728 : OAuth 2.0 Protected Resource Metadata

  role:authorization_serverspec:rfc9728
  #790·yannj-fr opened Aug 2, 2025·3 of 8 tasks·

  ·
  1

  10

• docs(custom-claims): add documentation for custom claims class usage with ORCID example

  #772·MartinPaulEve opened May 16, 2025·3 of 8 tasks·

  ·
  2