Skip to content

v2.3.0 — OAuth 2.1 for claude.ai web + Claude Desktop

Choose a tag to compare

View all tags
@syswave-dev syswave-dev released this 11 May 10:48
· 60 commits to main since this release
v2.3.0
a0e65c6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • OAuth 2.1 Authorization Code flow with PKCE-S256 for claude.ai web custom connector and Claude Desktop's custom-connector dialog (closes #6, #10)
  • Dynamic Client Registration (RFC 7591), HS256 JWT access tokens (RFC 9068, audience-bound, 1h TTL), opaque rotating refresh tokens (30d, chain-wide reuse detection)
  • RFC 8414 + 9728 discovery, RFC 7009 revocation
  • Opt-in via OAUTH_JWT_SECRET — behavior unchanged from v2.2.x without it

Important — :latest stays on v1.x

The :latest tag in Docker Hub and GHCR remains pinned to v1.2.x. To get v2.3.0 with OAuth, pin explicitly:

image: aeternalabshq/pullmd:2.3.0

See CHANGELOG.md and MIGRATION.md for full details.

Verified against

  • claude.ai web (custom connector)
  • Claude Desktop (custom-connector dialog)
Assets 2
Loading