Issues

• Honour id_token_signed_response_alg=HS256 for dynamically registered client_secret_jwt clients

  enhancement
  django-oauth/django-oauth-toolkit#1871 · Filter by author dopry opened on Oct 1, 2026

• UserInfo endpoint rejects RFC 8707 resource-bound access tokens (relative URI in create_userinfo_response)

  django-oauth/django-oauth-toolkit#1861 · Filter by author biagiodistefano opened on Sep 28, 2026

• CIMD ignores token_endpoint_auth_methods_supported and rejects usable clients

  bug
  django-oauth/django-oauth-toolkit#1857 · Filter by author flaviovl opened on Sep 20, 2026

• CIMD: a metadata document is rejected when it declares an extra grant_type the server doesn't support

  bug
  django-oauth/django-oauth-toolkit#1855 · Filter by author flaviovl opened on Sep 19, 2026
  1

• Serve up /o/token instead of redirecting it even if APPEND_SLASH is True

  django-oauth/django-oauth-toolkit#1851 · Filter by author mlissner opened on Sep 9, 2026
  1

• Support private_key_jwt in CIMD

  enhancement
  django-oauth/django-oauth-toolkit#1845 · Filter by author ewjoachim opened on Aug 26, 2026
  5

• Store and use logo_uri, client_uri, tos_uri, policy_uri, contacts from CIMD

  enhancement
  django-oauth/django-oauth-toolkit#1844 · Filter by author ewjoachim opened on Aug 25, 2026

• refactor: BaseAuthorizationView.error_response() narrows the mixin signature (breaking change, 4.0)

  enhancement
  django-oauth/django-oauth-toolkit#1829 · Filter by author dopry opened on Aug 21, 2026 · 4.0

• Policy setting: allow a refresh token to survive access-token revocation (4.x)

  enhancement
  django-oauth/django-oauth-toolkit#1786 · Filter by author dopry opened on Jul 25, 2026 · 4.0

• Explore runtime token-cleanup strategies (reduce reliance on a long-running cleartokens)

  enhancement
  django-oauth/django-oauth-toolkit#1783 · Filter by author dopry opened on Jul 25, 2026
  1

• Remove JSONOAuthLibCore (deprecated in 3.4.1)

  django-oauth/django-oauth-toolkit#1773 · Filter by author dopry opened on Jul 24, 2026 · 4.0
  4

• DCR: allowlist settings for registration metadata (grant_types, token_endpoint_auth_method, redirect_uris)

  enhancement
  django-oauth/django-oauth-toolkit#1731 · Filter by author dopry opened on Jul 7, 2026
  3

• ADR 0001: Authorization and Session entities in the token model

  enhancement
  django-oauth/django-oauth-toolkit#1723 · Filter by author dopry opened on Jul 5, 2026 · 4.0
  9

  

• Hash user tokens, refresh tokens and grants in the DB

  enhancement
  django-oauth/django-oauth-toolkit#1716 · Filter by author ewjoachim opened on Jun 17, 2026 · 4.0
  9

• oauth2_settings.AUTHENTICATION_SERVER_EXP_TIME_ZONE violates specification

  bug
  django-oauth/django-oauth-toolkit#1702 · Filter by author dopry opened on May 29, 2026 · 4.0
  3

• incorporate CachedOAuth2Validator improvement from LuizaLabs

  enhancement
  django-oauth/django-oauth-toolkit#1627 · Filter by author n2ygk opened on Dec 12, 2025 · 3.5
  1

• bug: logging in multiple times creates many access tokens

  bug
  django-oauth/django-oauth-toolkit#1605 · Filter by author dopry opened on Nov 1, 2025 · 4.0

• bug: Revoked ID tokens not deleted on refresh

  bug
  django-oauth/django-oauth-toolkit#1604 · Filter by author dopry opened on Nov 1, 2025 · 4.0
  1

• OIDC Back-Channel Logout

  enhancement
  django-oauth/django-oauth-toolkit#1545 · Filter by author lullis opened on Jan 28, 2025 · 4.0

• feat: Rotating/Multiple Client Secrets per Application

  enhancement
  django-oauth/django-oauth-toolkit#1507 · Filter by author dopry opened on Sep 27, 2024
  1

• Introspection endpoint doesn't require "introspection" scope when used in client-credentials flow

  bugsecurity
  django-oauth/django-oauth-toolkit#1451 · Filter by author makulatur opened on Aug 8, 2024 · 4.0
  7

  

• Refresh ID token help

  enhancement
  django-oauth/django-oauth-toolkit#1402 · Filter by author simonprice14 opened on Feb 26, 2024 · 4.0
  2

• feat: Restrict access to application registration

  enhancement
  django-oauth/django-oauth-toolkit#1371 · Filter by author marksweb opened on Dec 7, 2023 · 3.5
  1

• feat: docker images for a provider

  enhancement
  django-oauth/django-oauth-toolkit#1359 · Filter by author dopry opened on Nov 4, 2023 · 3.5
  2

• Add the possibility to map user info with user model field.

  enhancement
  django-oauth/django-oauth-toolkit#1325 · Filter by author fijemax opened on Sep 28, 2023
  11