v1.26.10
A mini release with a big bunch of boring OAuth2 things (that actually unlock a bunch of cool things!)
Auth Acronym Soup
OAuth2, OIDC, DCR and CIMD... I think that's all of them? Anyway, this is mostly for wiring your Storyden instance up to MCP clients and other third party integrations. Outside of integrating Storyden with your own software and systems, this also lets you grant access to the MCP to ChatGPT, Claude and other SaaS agents:
So what are DCR and CIMD? These essentially allow third parties such as ChatGPT share information with Storyden and vice versa so they can handshake the OAuth2 setup process a bit more smoothly. The end result is a simple "Connect" button click, grant permissions and get going.
DCR and CIMD are early, enable at your own risk. CIMD is also not a finalised standard so the spec (and thus Storyden's implementation) are subject to change.
For example, setting up a Storyden instance's MCP server in ChatGPT is literally:
- Paste your URL
- Click "Create"
- Click "Sign in with "
This is the magic of DCR and CIMD working together. DCR lets ChatGPT create an OAuth2 client ahead of time via /oauth/register and CIMD lets Storyden look up the stable client ID of ChatGPT as well as other metadata.
You can read more about DCR and CIMD support in the documentation.
Related commits:
- add RFC 8414 OAuth authorization server metadata endpoint by @Southclaws in #751
- implement rfc 9728 protected resource metadata by @Southclaws in #760
- Implement RFC 7591 OAuth 2.0 Dynamic Client Registration by @Southclaws in #759
- Add background cleanup job for unused DCR clients by @Southclaws in #761
- add Client ID Metadata Document (CIMD) support by @Southclaws in #758
- revoke refresh-token family on reuse by @Southclaws in #765
- deliver OAuth authorize errors via redirect by @Southclaws in #763
- add OIDC nonce to the authorization code flow by @Southclaws in #764
Full Changelog: v1.26.9...v1.26.10
