--- title: "authlib Breaking Changes on PyPI | Since.dev" description: "What each authlib release removed, renamed or changed: 139 breaking changes in 6 versions on PyPI, each with its source." canonical_url: https://since.dev/packages/pypi/authlib last_updated: 2026-10-14 --- # authlib breaking changes Every breaking API change we have recorded in authlib on PyPI: 139 breaking changes in 6 versions. Below are its newest 6 versions, removals and renames first, each with its source. Newest change October 14, 2026 ## 1.9.1 4 breaking changes, first published October 14, 2026. - **Behavior changed** Registration access tokens issued to another client are now refused with an access_denied error. [docs.authlib.org](https://docs.authlib.org/en/stable/upgrades/changelog.html) - **Behavior changed** `authlib.jose` authlib.jose now raises a ValueError for empty HMAC keys used with HS256, HS384 and HS512. Use a non-empty key. [docs.authlib.org](https://docs.authlib.org/en/stable/upgrades/changelog.html) - **Behavior changed** `TokenMixin.check_client` The RFC 7592 client configuration endpoint now calls check_client() on the registration access token. Token classes must implement TokenMixin.check_client. [docs.authlib.org](https://docs.authlib.org/en/stable/upgrades/changelog.html) - **Configuration changed** The package now requires joserfc 1.6.8 or later, so older joserfc installs must be upgraded. [docs.authlib.org](https://docs.authlib.org/en/stable/upgrades/changelog.html) ## 1.9.0 6 breaking changes, first published October 14, 2026. - **Behavior changed** Request URI retrieval is restricted to approved registered URIs or an explicit secure validation policy. Code fetching other request URIs will be rejected unless it is configured to allow them. [github.com](https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0) - **Behavior changed** ID-JAG grants now require client authentication. Clients that called ID-JAG grants without authenticating must now authenticate. [github.com](https://github.com/authlib/authlib/releases/tag/v1.9.0) - **Behavior changed** NumericDate claims no longer accept boolean values and will be rejected. Code that passes booleans in these claims must pass proper numeric timestamps. [github.com](https://github.com/authlib/authlib/releases/tag/v1.9.0) - **Behavior changed** OAuth now enforces JOSE key, scope and audience validation. Requests that previously passed with invalid keys, scopes or audiences may now be rejected. [github.com](https://github.com/authlib/authlib/releases/tag/v1.9.0) - **Behavior changed** `JWTBearerGrant.get_audiences` get_audiences() must now return a non-empty list of authorization server audience identifiers. Unconfigured grants now reject assertions with invalid_grant. [github.com](https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf) - **Behavior changed** `nonce_supported` Setting nonce_supported to false no longer bypasses nonce validation, and ID Token claims can no longer disable it. Code that relied on the bypass must now supply valid nonces. [github.com](https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0) ## 1.8.0 16 breaking changes, first published August 30, 2026. - **Behavior changed** Code that passes or relies on httpx objects through Authlib's client may need to move to httpx2. [github.com](https://github.com/authlib/authlib/releases/tag/v1.8.0) - **Behavior changed** Algorithm selection now follows that client metadata first, so check clients that set it alongside other algorithm settings. [github.com](https://github.com/authlib/authlib/releases/tag/v1.8.0) - **Behavior changed** Claims with None values are no longer included in the output. [github.com](https://github.com/authlib/authlib/releases/tag/v1.8.0) - **Behavior changed** `JWTBearerTokenGenerator` The sub claim is emitted as a string, so check code that expects another type. [github.com](https://github.com/authlib/authlib/releases/tag/v1.8.0) - **Signature changed** `authlib.integrations.httpx_client.AssertionClient` Was class AssertionClient(\_AssertionClient, httpx.Client); now class AssertionClient(\_AssertionClient, httpx2.Client). [pypi.org](https://pypi.org/project/Authlib/1.8.0/) - **Signature changed** `authlib.integrations.httpx_client.AssertionClient.__init__` Was def \_\_init\_\_(self, token_endpoint, issuer, subject, audience=None, grant_type=None, claims=None, token_placement='header', scope=None, \*\*kwargs); now def \_\_init\_\_(self, token_endpoint, issuer, subject, audience=None, grant_type=None... [pypi.org](https://pypi.org/project/Authlib/1.8.0/) - **Signature changed** `authlib.integrations.httpx_client.AsyncAssertionClient` Was class AsyncAssertionClient(\_AssertionClient, httpx.AsyncClient); now class AsyncAssertionClient(\_AssertionClient, httpx2.AsyncClient). [pypi.org](https://pypi.org/project/Authlib/1.8.0/) - **Signature changed** `authlib.integrations.httpx_client.AsyncOAuth1Client` Was class AsyncOAuth1Client(\_OAuth1Client, httpx.AsyncClient); now class AsyncOAuth1Client(\_OAuth1Client, httpx2.AsyncClient). [pypi.org](https://pypi.org/project/Authlib/1.8.0/) - **Signature changed** `authlib.integrations.httpx_client.AsyncOAuth2Client` Was class AsyncOAuth2Client(\_OAuth2Client, httpx.AsyncClient); now class AsyncOAuth2Client(\_OAuth2Client, httpx2.AsyncClient). [pypi.org](https://pypi.org/project/Authlib/1.8.0/) - **Signature changed** `authlib.integrations.httpx_client.OAuth1Client` Was class OAuth1Client(\_OAuth1Client, httpx.Client); now class OAuth1Client(\_OAuth1Client, httpx2.Client). [pypi.org](https://pypi.org/project/Authlib/1.8.0/) And 6 more in this version. ## 1.7.2 1 breaking change, first published May 6, 2026. - **Behavior changed** Language tags are now validated with a regular expression, so tags that were previously accepted may now be rejected. Check that any language tags you pass are valid BCP47 tags. [github.com](https://github.com/authlib/authlib/releases/tag/v1.7.2) ## 1.7.0 110 breaking changes, first published April 18, 2026. - **Removed** `authlib.integrations.base_client.OpenIDMixin.create_load_key` OpenIDMixin.create_load_key was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) - **Removed** `authlib.integrations.base_client.sync_openid.JsonWebKey` authlib.integrations.base_client.sync_openid.JsonWebKey was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) - **Removed** `authlib.integrations.base_client.sync_openid.JsonWebToken` authlib.integrations.base_client.sync_openid.JsonWebToken was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) - **Removed** `authlib.integrations.base_client.sync_openid.jwt` authlib.integrations.base_client.sync_openid.jwt was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) - **Removed** `authlib.oauth2.rfc7523.assertion.jwt` authlib.oauth2.rfc7523.assertion.jwt was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) - **Removed** `authlib.oauth2.rfc7523.client.JoseError` authlib.oauth2.rfc7523.client.JoseError was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) - **Removed** `authlib.oauth2.rfc7523.client.jwt` authlib.oauth2.rfc7523.client.jwt was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) - **Removed** `authlib.oauth2.rfc7523.jwt_bearer.JoseError` authlib.oauth2.rfc7523.jwt_bearer.JoseError was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) - **Removed** `authlib.oauth2.rfc7523.jwt_bearer.jwt` authlib.oauth2.rfc7523.jwt_bearer.jwt was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) - **Removed** `authlib.oauth2.rfc7523.JWTBearerClientAssertion.create_resolve_key_func` JWTBearerClientAssertion.create_resolve_key_func was removed in Authlib 1.7.0 [pypi.org](https://pypi.org/project/Authlib/1.7.0/) And 100 more in this version. ## 1.6.12 2 breaking changes, first published May 4, 2026. - **Behavior changed** `OpenIDHybridGrant` Errors for invalid scope in the OpenID hybrid grant no longer redirect to an unvalidated redirect_uri. Code that relied on that redirect must now use a validated redirect_uri. [github.com](https://github.com/authlib/authlib/releases/tag/v1.6.12) - **Behavior changed** `OpenIDImplicitGrant` Errors for invalid scope in the OpenID implicit grant no longer redirect to an unvalidated redirect_uri. Code that relied on that redirect must now use a validated redirect_uri. [github.com](https://github.com/authlib/authlib/releases/tag/v1.6.12) ## Check your code These are the changes. To see which of them reach your code, [scan a public repository](https://since.dev/scan.md), or have your coding agent call `check_code` with your manifest or lockfile over [MCP](https://since.dev/docs.md#mcp). [The API](https://since.dev/docs.md#api) reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys. ## Put your code on continuous management. Scan a public repository now, or give your agent one line. ### See how out of date your code is. [Scan a repository](https://since.dev/scan.md). Any public GitHub repository. No sign-in. ### Tell your agent what changed since it was trained. `claude mcp add --transport http since https://api.since.dev/mcp` --- Every page on this site as Markdown: https://since.dev/sitemap.md. For agents: https://since.dev/llms.txt.