Skip to content

v1.2.0 — REST API accepts OAuth sign-in tokens + /api/whoami

Choose a tag to compare

View all tags
@manfredas370 manfredas370 released this 07 Jul 07:29
v1.2.0
55a25bb

The REST API head (used by the Discogs Copilot extension) now accepts Worker-issued OAuth access tokens alongside Discogs personal access tokens — the same /authorize → /token bridge MCP clients already use. This powers the extension's new Sign in with Discogs (see ext-v0.2.0).

  • Bearer tokens shaped userId:grantId:secret are validated locally via the OAuth provider and resolve to the Discogs credentials stored encrypted in the grant — zero extra Discogs API calls
  • Discogs personal access tokens keep working unchanged (self-hosters, curl)
  • New GET /api/whoami → { username } — cheap authenticated identity probe
  • /api/health remains unauthenticated
  • Token policy: 1 h access tokens, 30 d rotating refresh tokens (provider defaults)

No MCP-head changes. Deployed to the hosted instance.

Full Changelog: v1.1.5...v1.2.0

Assets 2
Loading