oauthlib breaking changes

4.0.0

8 breaking changes, first published September 28, 2026.

• Removed
  The token revocation endpoint no longer supports JSONP responses. Code that relies on JSONP must switch to standard handling. github.com
• Removed
  Python 3.8 is no longer tested by the project. Users on Python 3.8 should upgrade their interpreter. github.com
• Removed oauthlib.oauth2.RevocationEndpoint.enable_jsonp
  RevocationEndpoint.enable_jsonp was removed in oauthlib 4.0.0 pypi.org
• Behavior changed
  The grant_type parameter is now checked before client authentication. Code that depends on the previous error order may see different failures. github.com
• Signature changed oauthlib.oauth2.Client.prepare_token_revocation_request
  Was def prepare_token_revocation_request(self, revocation_url, token, token_type_hint='access_token', body='', callback=None, **kwargs); now def prepare_token_revocation_request(self, revocation_url, token, token_type_hint='access_token'... pypi.org
• Signature changed oauthlib.oauth2.RevocationEndpoint.__init__
  Was def __init__(self, request_validator, supported_token_types=None, enable_jsonp=False); now def __init__(self, request_validator, supported_token_types=None). pypi.org
• Signature changed oauthlib.oauth2.rfc6749.clients.base.prepare_token_revocation_request
  Was def prepare_token_revocation_request(url, token, token_type_hint='access_token', callback=None, body='', **kwargs); now def prepare_token_revocation_request(url, token, token_type_hint='access_token', body='', **kwargs). pypi.org
• Signature changed oauthlib.oauth2.rfc6749.parameters.prepare_token_revocation_request
  Was def prepare_token_revocation_request(url, token, token_type_hint='access_token', callback=None, body='', **kwargs); now def prepare_token_revocation_request(url, token, token_type_hint='access_token', body='', **kwargs). pypi.org

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.