Changelog

Here you can see the full list of changes between each Authlib release.

Version 1.9.1 — 2026-10-14

Breaking changes

  • The RFC 7592 client configuration endpoint calls check_client() on the registration access token. Tokens must implement TokenMixin.check_client.

Security

  • authlib.jose rejects empty HMAC keys with a ValueError. An empty key used to let anyone forge HS256, HS384 and HS512 signatures. The minimum joserfc version is now 1.6.8, which has the same check. GHSA-8m4g-j4wp-wgcg

  • The RFC 7592 client configuration endpoint rejects registration access tokens issued to another client, with an access_denied error. A client could read, update or delete the registration of any other client. GHSA-c73q-w75p-j82v

Version 1.9.0

Released on Oct 14, 2026

  • Breaking change: ID Tokens with nonce_supported=false no longer bypass validation of the nonce saved by the client. Missing or mismatched nonces are rejected in both synchronous and asynchronous integrations. Provider compatibility exceptions must be explicitly configured by the application, rather than enabled by an ID Token claim. pull request #949

  • Enforce JAR require_signed_request_object independently of the signing algorithm configuration. An explicit algorithm list or a customized get_request_object_signing_algorithms() cannot allow alg=none when either the server or the client requires signed request objects. pull request #949

  • Breaking change: JAR request_uri is validated before retrieval and rejected by default. Applications must implement validate_request_uri() with an explicit secure retrieval policy. See RFC9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR) for retrieval safeguards. pull request #949

  • Add authlib.oidc.core.OpenIDJWTAuthenticationRequest to enforce OIDC require_request_uri_registration separately from the generic JAR retrieval policy. Registered URIs must also pass the application’s validation policy. See OpenID request objects. pull request #949

  • Reject PEM and SSH key material used as symmetric JOSE keys, including PEM keys with leading whitespace, comments, or a byte-order mark and keys supplied through an oct JWK or an OctKey instance. pull request #945

  • Use the client’s allowed scope when validating and issuing OIDC implicit and hybrid responses. Clients without the openid scope can no longer obtain an ID Token by including it in the raw request, and custom token generators receive only the allowed scope. pull request #945

  • Breaking change: JWTBearerGrant.get_audiences() must return a non-empty list of audience identifiers for the authorization server. Assertions are rejected with invalid_grant when audiences are not configured, instead of issuing a deprecation warning and skipping audience value validation. pull request #945

  • Require client authentication for ID-JAG token requests and bind the assertion’s client_id to the authenticated client. Missing or invalid credentials and client mismatches no longer allow token issuance. Rejected authentication and mismatches do not consume the assertion’s replay identifier. pull request #955

  • Add support for the Identity Assertion JWT Authorization Grant (ID-JAG), a draft extension to RFC 7523 for cross-application access using identity assertions issued by an external enterprise IdP. See ID-JAG: Identity Assertion JWT Authorization Grant for details. pull request #898

  • The async OpenID Connect client returns None from parse_id_token() when the token has no id_token, like the sync client. It used to raise a KeyError. pull request #924

  • OAuth 2 and assertion clients raise the HTTP error of the token endpoint response when its body is not a JSON object, such as a plain-text 429 page from a gateway. They used to raise a JSONDecodeError or a TypeError. A success response with such a body raises a ValueError. issue #928 pull request #929

  • JsonWebSignature.deserialize_json() rejects a JWS JSON Serialization with an empty signatures list. It used to accept it as valid. pull request #938

  • JWTClaims.validate() rejects boolean exp, nbf and iat values with an InvalidClaimError. issue #641 pull request #942

  • OAuth 1.0 clients send each OAuth parameter once when the signature is placed in the query string or the form body. Duplicated parameters used to produce an invalid signature. issue #542 pull request #943

Version 1.8.0

Released on Aug 30, 2026

  • Breaking change: authlib.integrations.httpx_client is now powered by httpx2 instead of httpx. Install httpx2 to keep using this integration; the public import path and class names are unchanged. When httpx2 is not installed, the integration falls back to httpx and emits an AuthlibDeprecationWarning. This fallback will be removed in a future release. issue #904

  • Breaking change: the client metadata id_token_signed_response_alg now takes precedence over get_jwt_config()["alg"] when signing OIDC id_token, in line with OpenID Connect Registration 1.0 Section 2. get_jwt_config()["alg"] is now used as a server-wide default when the client did not configure an algorithm. Override get_client_algorithm(client) if you need the previous behaviour. issue #806

  • Fix is_secure_transport() accepting cleartext URIs whose userinfo component looks like a loopback host, such as http://localhost:80@attacker.test/cb. The loopback exemption is now matched on the parsed host, and no longer requires an explicit port.

  • Reject URIs with a userinfo component during client and server metadata validation, as in https://client.test@attacker.test/cb. URIs that urlparse refuses to parse, such as http://[not-an-ip]/, are also rejected instead of raising an unhandled ValueError.

  • Cast the sub claim to a string in the RFC 9068 and RFC 7523 JWTBearerTokenGenerator, as required by RFC 7519 Section 4.1.2. joserfc 1.7.3 started validating this claim and rejected the previously emitted non-string values (e.g. an integer get_user_id()). issue #910 pull request #911

  • Require joserfc>=1.6.1 and cryptography>=45.0.1. The RFC 9068 amr validation uses InvalidClaimError’s description argument, added in joserfc 1.6.1.

  • Declare lower bounds for the optional integration dependencies and test them in CI against their minimum versions with uv’s lowest-direct resolution.

  • The token endpoint answers malformed RFC 7523 assertions with an invalid_client or invalid_grant error instead of raising an unhandled exception. JWTBearerGrant.resolve_issuer_client() may return None for an unknown issuer.

  • The RFC 9068 JWTBearerTokenValidator answers with an invalid_token error for any JoseError raised while decoding an access token, instead of only DecodeError. An unknown kid used to raise an unhandled InvalidKeyIdError. pull request #891

  • Add a leeway parameter to the RFC 7523 JWTBearerTokenValidator, which used to be hardcoded to 60 seconds. pull request #903

  • sign_jwt_bearer_assertion() generates a default jti claim when the caller did not provide one, as RFC 7523 §3 recommends against replay attacks. This matches what OAuth2Session already did for client assertions. pull request #897

  • Add optional client_id parameter to AssertionClient (and its AssertionSession / httpx wrappers) so it can be sent in the token endpoint request body per RFC 7521 §4.1 and RFC 6749 §3.2.1. pull request #476

  • The OpenID Connect client no longer rejects an id_token whose JWS header carries unregistered parameters. issue #902

  • Omit the nonce and auth_time claims from the id_token instead of emitting them with a null value. issue #921

  • DeviceAuthorizationEndpoint saves the device credential with the authenticated client id. It used to read request.payload.client_id, which is None when the client authenticates with client_secret_basic. issue #798 pull request #908

  • Fix the OAuth 1.0a InsecureTransportError description telling users that OAuth 2 must use HTTPS. pull request #919

Version 1.7.2

Released on May 6, 2026

  • Fix PrivateKeyJWT rejecting ECKey private keys (e.g. for ES256). The client private key is no longer forcibly imported as an RSAKey; joserfc’s key auto-detection is used instead. pull request #852

  • Allow ClientSecretJWT and PrivateKeyJWT to sign client assertions with non-recommended algorithms (e.g. RS384) when explicitly set via the alg parameter. issue #883

  • Validate BCP 47 language tags in ui_locales_supported, claims_locales_supported and UserInfo.locale. pull request #873

Version 1.7.1

Released on May 4, 2026

  • Fix AuthlibDeprecationWarning being emitted on import when using integrations that do not use authlib.jose directly. issue #880

  • Fix redirecting to unvalidated redirect_uri on InvalidScopeError in OpenIDImplicitGrant and OpenIDHybridGrant.

Version 1.7.0

Released on Apr 18, 2026

  • Add support for OpenID Connect RP-Initiated Logout 1.0. See OpenID Connect RP-Initiated Logout 1.0 for details. issue #500

  • Per RFC 6749 Section 3.3, the scope parameter is now optional at both authorization and token endpoints. client.get_allowed_scope() is called to determine the default scope when omitted. issue #845

  • Stop support for Python 3.9, start support Python 3.14. pull request #850

  • Allow AuthorizationServerMetadata.validate() to compose with RFC extension classes.

  • Fix expires_at=0 being incorrectly treated as None. issue #530

  • Allow ResourceProtector decorator to be used without parentheses. issue #604

  • Implement RFC9700 PKCE downgrade countermeasure.

  • Set User-Agent header when fetching server metadata and JWKs. issue #704

  • RFC7523 accepts the issuer URL as a valid audience. issue #730

  • Fix InvalidTokenError extra attributes being wrapped instead of passed as individual key=value pairs in the WWW-Authenticate header. pull request #872

Upgrade Guide: joserfc migration.

Version 1.6.11

Released on Apr 16, 2026

  • Fix CSRF vulnerability in the Starlette OAuth client when a cache is configured.

Version 1.6.10

Released on Apr 13, 2026

  • Fix redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError.

Version 1.6.9

Released on Mar 2, 2026

  • Not using header’s jwk automatically.

  • Add ES256K into default jwt algorithms.

  • Remove deprecated algorithm from default registry.

  • Generate random cek when cek length doesn’t match.

Version 1.6.8

Released on Feb 17, 2026

  • Add EdDSA to default jwt instance.

Version 1.6.7

Released on Feb 6, 2026

  • Set supported algorithms for the default jwt instance.

Version 1.6.6

Released on Jan 9, 2026

  • get_jwt_config takes a client parameter, pull request #844.

  • Fix incorrect signature when Content-Type is x-www-form-urlencoded for OAuth 1.0 Client, pull request #778.

  • Use expires_in in OAuth2Token when expires_at is unparsable, pull request #842.

  • Always track state in session for OAuth client integrations.

Version 1.6.5

Released on Oct 2, 2025

  • RFC7591 generate_client_info and generate_client_secret take a request parameter.

  • Add size limitation when decode JWS/JWE to prevent DoS.

  • Add size limitation for DEF JWE zip algorithm.

Version 1.6.4

Released on Sep 17, 2025

  • Fix InsecureTransportError error raising. issue #795

  • Fix response_mode=form_post with Starlette client. issue #793

  • Validate crit header value, reject unprotected header in crit header.

Version 1.6.3

Released on Aug 26, 2025

  • OIDC id_token are signed according to id_token_signed_response_alg client metadata. issue #755

Version 1.6.2

Released on Aug 23, 2025

Version 1.6.1

Released on Jul 20, 2025

  • Filter key set with additional “alg” and “use” parameters.

  • Restore and deprecate OAuth2Request body parameter. issue #781

Version 1.6.0

Released on May 22, 2025

Breaking changes:

  • Support for acr and amr claims in id_token. issue #734 The OAuth2AuthorizationCodeMixin must have a migration to support the new fields.

Version 1.5.2

Released on Apr 1, 2025

  • Forbid fragments in redirect_uris. issue #714

  • Fix invalid characters in error_description. issue #720

  • Add claims_cls parameter for client’s parse_id_token method. issue #725

Version 1.5.1

Released on Feb 28, 2025

Version 1.5.0

Released on Feb 25, 2025

Version 1.4.1

Released on Jan 28, 2025

  • Improve garbage collection on OAuth clients. issue #698

  • Fix client parameters for httpx. issue #694

Version 1.4.0

Released on Dec 20, 2024

Breaking changes:

Version 1.3.2

Released on Aug 30 2024

  • Prevent ever-growing session size for OAuth clients.

  • Revert quote client id and secret.

  • unquote basic auth header for authorization server.

Version 1.3.1

Released on June 4, 2024

  • Prevent OctKey to import ssh and PEM strings.

Version 1.3.0

Released on Dec 17, 2023

New features:

Breaking changes:

  • End support for python 3.7

Version 1.2.1

Released on Jun 25, 2023

Version 1.2.0

Released on Dec 6, 2022

  • Not passing request.body to ResourceProtector, via issue #485.

  • Use flask.g instead of _app_ctx_stack, via issue #482.

  • Add headers parameter back to ClientSecretJWT, via issue #457.

  • Always passing realm parameter in OAuth 1 clients, via issue #339.

  • Implemented RFC7592 Dynamic Client Registration Management Protocol, via pull request #505.

  • Add default_timeout for requests OAuth2Session and AssertionSession.

  • Deprecate jwk.loads and jwk.dumps

Version 1.1.0

Released on Sep 13, 2022

This release contains breaking changes and security fixes.

Breaking changes:

  • Raise InvalidGrantError for invalid code, redirect_uri and no user errors in OAuth 2.0 server.

  • The default authlib.jose.jwt would only work with JSON Web Signature algorithms, if you would like to use JWT with JWE algorithms, please pass the algorithms parameter:

    jwt = JsonWebToken(['A128KW', 'A128GCM', 'DEF'])

Security fixes: CVE-2022-39175 and CVE-2022-39174, both related to JOSE.

Version 1.0.1

Released on Apr 6, 2022

  • Fix authenticate_none method, via issue #438.

  • Allow to pass in alternative signing algorithm to RFC7523 authentication methods via pull request #447.

  • Fix missing_token for Flask OAuth client, via issue #448.

  • Allow openid in any place of the scope, via issue #449.

  • Security fix for validating essential value on blank value in JWT, via issue #445.

Version 1.0.0

Released on Mar 15, 2022.

We have dropped support for Python 2 in this release. We have removed built-in SQLAlchemy integration.

OAuth Client Changes:

The whole framework client integrations have been restructured, if you are using the client properly, e.g. oauth.register(...), it would work as before.

OAuth Provider Changes:

In Flask OAuth 2.0 provider, we have removed the deprecated OAUTH2_JWT_XXX configuration, instead, developers should define .get_jwt_config on OpenID extensions and grant types.

SQLAlchemy integrations has been removed from Authlib. Developers should define the database by themselves.

JOSE Changes

  • JWS has been renamed to JsonWebSignature

  • JWE has been renamed to JsonWebEncryption

  • JWK has been renamed to JsonWebKey

  • JWT has been renamed to JsonWebToken

The “Key” model has been re-designed, checkout the JSON Web Key (JWK) for updates.

Added ES256K algorithm for JWS and JWT.

Breaking Changes: find how to solve the deprecate issues via https://git.io/JkY4f

Old Versions

Find old changelog at https://github.com/authlib/authlib/releases

  • Version 0.15.5: Released on Oct 18, 2021

  • Version 0.15.4: Released on Jul 17, 2021

  • Version 0.15.3: Released on Jan 15, 2021

  • Version 0.15.2: Released on Oct 18, 2020

  • Version 0.15.1: Released on Oct 14, 2020

  • Version 0.15.0: Released on Oct 10, 2020

  • Version 0.14.3: Released on May 18, 2020

  • Version 0.14.2: Released on May 6, 2020

  • Version 0.14.1: Released on Feb 12, 2020

  • Version 0.14.0: Released on Feb 11, 2020

  • Version 0.13.0: Released on Nov 11, 2019

  • Version 0.12.0: Released on Sep 3, 2019

  • Version 0.11.0: Released on Apr 6, 2019

  • Version 0.10.0: Released on Oct 12, 2018

  • Version 0.9.0: Released on Aug 12, 2018

  • Version 0.8.0: Released on Jun 17, 2018

  • Version 0.7.0: Released on Apr 28, 2018

  • Version 0.6.0: Released on Mar 20, 2018

  • Version 0.5.1: Released on Feb 11, 2018

  • Version 0.5.0: Released on Feb 11, 2018

  • Version 0.4.1: Released on Feb 2, 2018

  • Version 0.4.0: Released on Jan 31, 2018

  • Version 0.3.0: Released on Dec 24, 2017

  • Version 0.2.1: Released on Dec 6, 2017

  • Version 0.2.0: Released on Nov 25, 2017

  • Version 0.1.0: Released on Nov 18, 2017