--- title: "@azure/msal-node Breaking Changes on npm | Since.dev" description: "What each @azure/msal-node release removed, renamed or changed: 22 breaking changes in 7 versions on npm, each with its source." canonical_url: https://since.dev/packages/npm/@azure/msal-node last_updated: 2026-10-13 --- # @azure/msal-node breaking changes Every breaking API change we have recorded in @azure/msal-node on npm: 22 breaking changes in 7 versions. Below are its newest 6 versions, removals and renames first, each with its source. Newest change October 13, 2026 ## 7.1.0 1 breaking change, first published October 13, 2026. - **Behavior changed** Confidential client flows now reject instance-aware inputs they do not support and sanitize authorization code payloads. Code that passes such inputs must stop passing them or handle the new rejection. [github.com](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.1.0) ## 7.0.2 2 breaking changes, first published October 13, 2026. - **Behavior changed** Confidential client flows now reject instance-aware inputs they do not support, which previously were accepted. Code passing such inputs must remove them or use a supported configuration. [github.com](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.0.2) - **Signature changed** `ConfidentialClientApplication.acquireTokenByCode` Was acquireTokenByCode(request: AuthorizationCodeRequest, authCodePayLoad?: AuthorizationCodePayload): Promise; now acquireTokenByCode(request: AuthorizationCodeRequest, authCodePayload?: AuthorizationCodePayload)... [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/7.0.2) ## 7.0.0 3 breaking changes, first published September 23, 2026. - **Removed** `acquireTokenInteractive.responseMode` The responseMode option is removed from acquireTokenInteractive. Code that passes it must stop passing it. [github.com](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.0.0) - **Behavior changed** `acquireTokenInteractive` Browser-loopback authentication requires form_post. Code relying on other response modes must be updated. [github.com](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v7.0.0) - **Signature changed** `InteractiveRequest` Was type InteractiveRequest = Partial> & {openBrowser: (url: string) => Promise; scopes?: Array; successTemplate?: string; errorTemplate?: string; windowHandle?... [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/7.0.0) ## 6.0.0 4 breaking changes, first published August 28, 2026. - **Removed** `ILoopbackClient` The ILoopbackClient interface and its export are removed. Code that implements or imports it must stop using it and rely on the built-in loopback server. [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/6.0.0) - **Removed** `InteractiveRequest.loopbackClient` The deprecated loopbackClient request option is removed. Remove it from acquireTokenInteractive calls and use the built-in loopback server. [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/6.0.0) - **Default changed** `acquireTokenInteractive` Interactive sign-in now defaults to form_post instead of query. Set responseMode to query explicitly if your app needs the old behavior. [github.com](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v6.0.0) - **Signature changed** `InteractiveRequest` Was type InteractiveRequest = Partial> & {openBrowser: (url: string) => Promise; scopes?: Array; successTemplate?: string; errorTemplate?: string; windowHandle?... [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/6.0.0) ## 5.6.0 6 breaking changes, first published August 18, 2026. - **Removed** `CryptoProvider.getPublicKeyThumbprint` CryptoProvider.getPublicKeyThumbprint was removed in @azure/msal-node 5.6.0 [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/5.6.0) - **Removed** `CryptoProvider.signJwt` CryptoProvider.signJwt was removed in @azure/msal-node 5.6.0 [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/5.6.0) - **Behavior changed** The ID Token nonce is checked against the nonce supplied on authorization code requests. Code that previously accepted a mismatched nonce may now fail and must send the matching nonce. [github.com](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases/tag/msal-node-v5.6.0) - **Signature changed** `AuthorizationCodeRequest` Was type AuthorizationCodeRequest = Partial> & {scopes: Array... [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/5.6.0) - **Signature changed** `CryptoProvider.clearKeystore` Was clearKeystore(): Promise; now clearKeystore(correlationId: string): Promise. [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/5.6.0) - **Signature changed** `CryptoProvider.removeTokenBindingKey` Was removeTokenBindingKey(): Promise; now removeTokenBindingKey(kid: string, correlationId: string): Promise. [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/5.6.0) ## 5.4.0 1 breaking change, first published July 7, 2026. - **Signature changed** `InteractiveRequest` Was type InteractiveRequest = Partial> & {openBrowser: (url: string) => Promise; scopes?: Array; successTemplate?: string; errorTemplate?: string; windowHandle?... [npmjs.com](https://www.npmjs.com/package/@azure/msal-node/v/5.4.0) ## Check your code These are the changes. To see which of them reach your code, [scan a public repository](https://since.dev/scan.md), or have your coding agent call `check_code` with your manifest or lockfile over [MCP](https://since.dev/docs.md#mcp). [The API](https://since.dev/docs.md#api) reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys. ## Put your code on continuous management. Scan a public repository now, or give your agent one line. ### See how out of date your code is. [Scan a repository](https://since.dev/scan.md). Any public GitHub repository. No sign-in. ### Tell your agent what changed since it was trained. `claude mcp add --transport http since https://api.since.dev/mcp` --- Every page on this site as Markdown: https://since.dev/sitemap.md. For agents: https://since.dev/llms.txt.