@azure/msal-node breaking changes

7.1.0

1 breaking change, first published October 13, 2026.

• Behavior changed
  Confidential client flows now reject instance-aware inputs they do not support and sanitize authorization code payloads. Code that passes such inputs must stop passing them or handle the new rejection. github.com

7.0.2

2 breaking changes, first published October 13, 2026.

• Behavior changed
  Confidential client flows now reject instance-aware inputs they do not support, which previously were accepted. Code passing such inputs must remove them or use a supported configuration. github.com
• Signature changed ConfidentialClientApplication.acquireTokenByCode
  Was acquireTokenByCode(request: AuthorizationCodeRequest, authCodePayLoad?: AuthorizationCodePayload): Promise<AuthenticationResult>; now acquireTokenByCode(request: AuthorizationCodeRequest, authCodePayload?: AuthorizationCodePayload)... npmjs.com

7.0.0

3 breaking changes, first published September 23, 2026.

• Removed acquireTokenInteractive.responseMode
  The responseMode option is removed from acquireTokenInteractive. Code that passes it must stop passing it. github.com
• Behavior changed acquireTokenInteractive
  Browser-loopback authentication requires form_post. Code relying on other response modes must be updated. github.com
• Signature changed InteractiveRequest
  Was type InteractiveRequest = Partial<Omit<CommonAuthorizationUrlRequest, "scopes" | "storeInCache">> & {openBrowser: (url: string) => Promise<void>; scopes?: Array<string>; successTemplate?: string; errorTemplate?: string; windowHandle?... npmjs.com

6.0.0

4 breaking changes, first published August 28, 2026.

• Removed ILoopbackClient
  The ILoopbackClient interface and its export are removed. Code that implements or imports it must stop using it and rely on the built-in loopback server. npmjs.com
• Removed InteractiveRequest.loopbackClient
  The deprecated loopbackClient request option is removed. Remove it from acquireTokenInteractive calls and use the built-in loopback server. npmjs.com
• Default changed acquireTokenInteractive
  Interactive sign-in now defaults to form_post instead of query. Set responseMode to query explicitly if your app needs the old behavior. github.com
• Signature changed InteractiveRequest
  Was type InteractiveRequest = Partial<Omit<CommonAuthorizationUrlRequest, "scopes" | "storeInCache">> & {openBrowser: (url: string) => Promise<void>; scopes?: Array<string>; successTemplate?: string; errorTemplate?: string; windowHandle?... npmjs.com

5.6.0

6 breaking changes, first published August 18, 2026.

• Removed CryptoProvider.getPublicKeyThumbprint
  CryptoProvider.getPublicKeyThumbprint was removed in @azure/msal-node 5.6.0 npmjs.com
• Removed CryptoProvider.signJwt
  CryptoProvider.signJwt was removed in @azure/msal-node 5.6.0 npmjs.com
• Behavior changed
  The ID Token nonce is checked against the nonce supplied on authorization code requests. Code that previously accepted a mismatched nonce may now fail and must send the matching nonce. github.com
• Signature changed AuthorizationCodeRequest
  Was type AuthorizationCodeRequest = Partial<Omit<CommonAuthorizationCodeRequest, "scopes" | "redirectUri" | "code" | "authenticationScheme" | "resourceRequestMethod" | "resourceRequestUri" | "storeInCache">> & {scopes: Array<string>... npmjs.com
• Signature changed CryptoProvider.clearKeystore
  Was clearKeystore(): Promise<boolean>; now clearKeystore(correlationId: string): Promise<boolean>. npmjs.com
• Signature changed CryptoProvider.removeTokenBindingKey
  Was removeTokenBindingKey(): Promise<void>; now removeTokenBindingKey(kid: string, correlationId: string): Promise<void>. npmjs.com

5.4.0

1 breaking change, first published July 7, 2026.

• Signature changed InteractiveRequest
  Was type InteractiveRequest = Partial<Omit<CommonAuthorizationUrlRequest, "scopes" | "storeInCache">> & {openBrowser: (url: string) => Promise<void>; scopes?: Array<string>; successTemplate?: string; errorTemplate?: string; windowHandle?... npmjs.com

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.