authlib breaking changes

1.9.1

4 breaking changes, first published October 14, 2026.

• Behavior changed
  Registration access tokens issued to another client are now refused with an access_denied error. docs.authlib.org
• Behavior changed authlib.jose
  authlib.jose now raises a ValueError for empty HMAC keys used with HS256, HS384 and HS512. Use a non-empty key. docs.authlib.org
• Behavior changed TokenMixin.check_client
  The RFC 7592 client configuration endpoint now calls check_client() on the registration access token. Token classes must implement TokenMixin.check_client. docs.authlib.org
• Configuration changed
  The package now requires joserfc 1.6.8 or later, so older joserfc installs must be upgraded. docs.authlib.org

1.9.0

6 breaking changes, first published October 14, 2026.

• Behavior changed
  Request URI retrieval is restricted to approved registered URIs or an explicit secure validation policy. Code fetching other request URIs will be rejected unless it is configured to allow them. github.com
• Behavior changed
  ID-JAG grants now require client authentication. Clients that called ID-JAG grants without authenticating must now authenticate. github.com
• Behavior changed
  NumericDate claims no longer accept boolean values and will be rejected. Code that passes booleans in these claims must pass proper numeric timestamps. github.com
• Behavior changed
  OAuth now enforces JOSE key, scope and audience validation. Requests that previously passed with invalid keys, scopes or audiences may now be rejected. github.com
• Behavior changed JWTBearerGrant.get_audiences
  get_audiences() must now return a non-empty list of authorization server audience identifiers. Unconfigured grants now reject assertions with invalid_grant. github.com
• Behavior changed nonce_supported
  Setting nonce_supported to false no longer bypasses nonce validation, and ID Token claims can no longer disable it. Code that relied on the bypass must now supply valid nonces. github.com

1.8.0

16 breaking changes, first published August 30, 2026.

• Behavior changed
  Code that passes or relies on httpx objects through Authlib's client may need to move to httpx2. github.com
• Behavior changed
  Algorithm selection now follows that client metadata first, so check clients that set it alongside other algorithm settings. github.com
• Behavior changed
  Claims with None values are no longer included in the output. github.com
• Behavior changed JWTBearerTokenGenerator
  The sub claim is emitted as a string, so check code that expects another type. github.com
• Signature changed authlib.integrations.httpx_client.AssertionClient
  Was class AssertionClient(_AssertionClient, httpx.Client); now class AssertionClient(_AssertionClient, httpx2.Client). pypi.org
• Signature changed authlib.integrations.httpx_client.AssertionClient.__init__
  Was def __init__(self, token_endpoint, issuer, subject, audience=None, grant_type=None, claims=None, token_placement='header', scope=None, **kwargs); now def __init__(self, token_endpoint, issuer, subject, audience=None, grant_type=None... pypi.org
• Signature changed authlib.integrations.httpx_client.AsyncAssertionClient
  Was class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient); now class AsyncAssertionClient(_AssertionClient, httpx2.AsyncClient). pypi.org
• Signature changed authlib.integrations.httpx_client.AsyncOAuth1Client
  Was class AsyncOAuth1Client(_OAuth1Client, httpx.AsyncClient); now class AsyncOAuth1Client(_OAuth1Client, httpx2.AsyncClient). pypi.org
• Signature changed authlib.integrations.httpx_client.AsyncOAuth2Client
  Was class AsyncOAuth2Client(_OAuth2Client, httpx.AsyncClient); now class AsyncOAuth2Client(_OAuth2Client, httpx2.AsyncClient). pypi.org
• Signature changed authlib.integrations.httpx_client.OAuth1Client
  Was class OAuth1Client(_OAuth1Client, httpx.Client); now class OAuth1Client(_OAuth1Client, httpx2.Client). pypi.org

And 6 more in this version.

1.7.2

1 breaking change, first published May 6, 2026.

• Behavior changed
  Language tags are now validated with a regular expression, so tags that were previously accepted may now be rejected. Check that any language tags you pass are valid BCP47 tags. github.com

1.7.0

110 breaking changes, first published April 18, 2026.

• Removed authlib.integrations.base_client.OpenIDMixin.create_load_key
  OpenIDMixin.create_load_key was removed in Authlib 1.7.0 pypi.org
• Removed authlib.integrations.base_client.sync_openid.JsonWebKey
  authlib.integrations.base_client.sync_openid.JsonWebKey was removed in Authlib 1.7.0 pypi.org
• Removed authlib.integrations.base_client.sync_openid.JsonWebToken
  authlib.integrations.base_client.sync_openid.JsonWebToken was removed in Authlib 1.7.0 pypi.org
• Removed authlib.integrations.base_client.sync_openid.jwt
  authlib.integrations.base_client.sync_openid.jwt was removed in Authlib 1.7.0 pypi.org
• Removed authlib.oauth2.rfc7523.assertion.jwt
  authlib.oauth2.rfc7523.assertion.jwt was removed in Authlib 1.7.0 pypi.org
• Removed authlib.oauth2.rfc7523.client.JoseError
  authlib.oauth2.rfc7523.client.JoseError was removed in Authlib 1.7.0 pypi.org
• Removed authlib.oauth2.rfc7523.client.jwt
  authlib.oauth2.rfc7523.client.jwt was removed in Authlib 1.7.0 pypi.org
• Removed authlib.oauth2.rfc7523.jwt_bearer.JoseError
  authlib.oauth2.rfc7523.jwt_bearer.JoseError was removed in Authlib 1.7.0 pypi.org
• Removed authlib.oauth2.rfc7523.jwt_bearer.jwt
  authlib.oauth2.rfc7523.jwt_bearer.jwt was removed in Authlib 1.7.0 pypi.org
• Removed authlib.oauth2.rfc7523.JWTBearerClientAssertion.create_resolve_key_func
  JWTBearerClientAssertion.create_resolve_key_func was removed in Authlib 1.7.0 pypi.org

And 100 more in this version.

1.6.12

2 breaking changes, first published May 4, 2026.

• Behavior changed OpenIDHybridGrant
  Errors for invalid scope in the OpenID hybrid grant no longer redirect to an unvalidated redirect_uri. Code that relied on that redirect must now use a validated redirect_uri. github.com
• Behavior changed OpenIDImplicitGrant
  Errors for invalid scope in the OpenID implicit grant no longer redirect to an unvalidated redirect_uri. Code that relied on that redirect must now use a validated redirect_uri. github.com

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.