All pull requests

Pull requests

• Fix AsyncOAuth2Client.ensure_active_token using a stale token after the refresh lock

  #963·GautamVhavle opened Oct 15, 2026·

  ·

• docs: show JWT access token validation and multiple issuers for resource servers

  #962·Xander-AJ opened Oct 15, 2026·

  ·
  1

• docs: explain how to read custom claims in the OIDC client

  #961·Xander-AJ opened Oct 15, 2026·

  ·
  1

• docs: document leeway and other OAuth2Session options in client_kwargs

  #960·Xander-AJ opened Oct 15, 2026·

  ·
  1

• fix(oauth): return no error code for requests without Bearer credentials

  role:authorization_serverspec:rfc6750
  #956·azmeuk opened Oct 14, 2026Member·

  ·

• fix(client): initialize httpx clients via super()

  #953·cpruijsen opened Oct 12, 2026Contributor·

  ·
  1

• Refresh client-credentials tokens when grant_type is unset

  #952·Cherith1222 opened Oct 11, 2026·

  ·
  1

  1

• feat(client): allow custom client assertion lifetime in JWT client auth

  #951·choksi2212 opened Oct 10, 2026·

  ·
  1

  5

• feat(client): verify signed UserInfo responses per OIDC Core 5.3.2

  #950·choksi2212 opened Oct 10, 2026·

  ·
  1

  6

• Fixes CVE-2026-104056: bind discovery metadata issuer to server_metadata_url origin

  #948·Pinky-Chaudhary opened Oct 9, 2026·

  ·
  14

• fix: Automatically fetch initial client credentials tokens in HTTPX OAuth2 clients

  #946·acob1 opened Oct 9, 2026·

  ·
  20

• Generate PKCE code_verifier per RFC 7636 charset

  #937·pranjalm37 opened Sep 18, 2026·

  ·
  1

• update token when fetching

  #936·calestyo opened Sep 5, 2026·

  ·

• Accept httpx URL objects on OAuth client requests

  #934·gyanu2507 opened Aug 30, 2026·

  ·
  1

  7

• feat(oauth2): support form_post response mode on the authorization code and implicit grants

  #927·ChrisJr404 opened Aug 25, 2026·

  ·
  1

  1

• feat: let ResourceProtector take a token_validator in __init__

  #925·pryzmatical opened Aug 22, 2026·

  ·
  1

  1

• Address Issue#735 - Initiating User Registration via OpenID Connect 1.0

  #907·cybersreejith opened Jul 4, 2026·

  ·
  1

  1

• Search for access token in body of userinfo requests #756

  #905·frohrlich opened Jun 19, 2026Contributor·6 tasks·

  ·
  1

• feat: add token_endpoint_verify for custom CA on token requests

  #896·liudonggalaxy opened May 19, 2026Contributor·5 of 6 tasks·

  ·

• feat: auto-fetch token for client_credentials grant in OAuth2Session/OAuth2Client

  #895·liudonggalaxy opened May 18, 2026Contributor·5 of 6 tasks·

  ·
  2

• feat: add should_handle hook for JWT client auth algorithm routing

  #894·liudonggalaxy opened May 15, 2026Contributor·5 of 6 tasks·

  ·

• feat: fallback to trying all JWKS keys when kid does not match

  #893·liudonggalaxy opened May 15, 2026Contributor·5 of 6 tasks·

  ·
  2

• feat: Include issued_at and expires_at in token response, respect server timestamps on client

  #892·liudonggalaxy opened May 15, 2026Contributor·5 of 6 tasks·

  ·
  1

• feat: Forward extra kwargs (expires_in, issued_at) through ClientSecretJWT and PrivateKeyJWT

  #890·liudonggalaxy opened May 15, 2026Contributor·5 of 6 tasks·

  ·

• feat: Auto-propagate kid and alg from JWK to JWT header in RFC 7523 assertion signing

  #889·liudonggalaxy opened May 14, 2026Contributor·5 of 6 tasks·

  ·
  4