Issues

• Public clients that send an empty or extra client_secret are rejected at /token after upgrading to 1.x

  bug
  cloudflare/workers-oauth-provider#404 · Filter by author ksinder opened on Oct 6, 2026
  

• Deprecate resolveExternalToken and ExternalTokenError in favour of the split API's validateToken

  enhancement
  cloudflare/workers-oauth-provider#382 · Filter by author mattzcarey opened on Sep 25, 2026
  

• Opaque access tokens should identify their issuer

  enhancement
  cloudflare/workers-oauth-provider#380 · Filter by author mattzcarey opened on Sep 25, 2026

• RFC: upstream OAuth client for proxy servers (beginUpstream/finishUpstream/refreshUpstream)

  enhancement
  cloudflare/workers-oauth-provider#336 · Filter by author mattzcarey opened on Sep 24, 2026
  1

  

• RFC: consent and upstream-state helpers for MCP proxy servers

  enhancement
  cloudflare/workers-oauth-provider#334 · Filter by author mattzcarey opened on Sep 24, 2026
  

• feat: pinned Client ID Metadata Documents (clientIdMetadataDocuments), upstreaming Sentry's patch

  enhancement
  cloudflare/workers-oauth-provider#333 · Filter by author mattzcarey opened on Sep 24, 2026

• feat: support RFC 9068 JWT access tokens with JWKS key rotation

  enhancement
  cloudflare/workers-oauth-provider#278 · Filter by author mattzcarey opened on Jul 31, 2026

• feat: add a strict MCP 2026 authorization profile

  enhancement
  cloudflare/workers-oauth-provider#262 · Filter by author mattzcarey opened on Jul 29, 2026

• Refresh-token rotation state on KV is racy under concurrent refresh; consider DO-backed serialization or idempotent rotation

  enhancement
  cloudflare/workers-oauth-provider#214 · Filter by author ksinder opened on May 29, 2026
  1

• feat: DPoP support (RFC 9449) — proof-of-possession token binding

  cloudflare/workers-oauth-provider#191 · Filter by author Talador12 opened on Apr 9, 2026

• Allowing the previous refresh token makes RT rotation useless

  cloudflare/workers-oauth-provider#43 · Filter by author neilmadden-teya opened on Jun 6, 2025
  5