Repository navigation
feat(oidc): refresh tokens and client credentials #408
Description
Why
Long-lived sessions and machine-to-machine access are table stakes for a provider.
What
- Refresh with rotation and reuse detection, matching the existing session model
- Client credentials grant with scopes
Done when
Both grants pass the conformance suite where applicable.
Activity
Bccorb commentedon Oct 30, 2026
Architecture for this is settled in ADR 0001 (#520). The OpenID Provider runs in a separate public login edge (new repo, seamless-auth-oidc-provider) that signs users in through the first-party routes. The auth API stays private and cookie-free. See D1, D3 and D5. The edge uses the library's rotation and reuse detection. On reuse, the API also revokes the linked
sessionsrow.Bccorb commentedon Nov 1, 2026
Shipped in v0.21.0. Refresh rotation with reuse detection (seamless-auth-oidc-provider#19 and #25, API #538) and the client credentials grant (seamless-auth-oidc-provider#19), with per-application token lifetimes (seamless-auth-oidc-provider#26, API #539). Closing.