Release 0.11.0

0.11.0 (2026-11-13)

Release 0.10.0

0.10.0 (2026-11-04)

Bug Fixes

• accept the Bearer scheme case-insensitively at UserInfo (cab0609)
• drop JSON column defaults rejected by MySQL 8 (d19ff1a)
• fall back to the other token type on a wrong token_type_hint (ed87d87)
• format Lucid query dates with the dialect format (337e4a9)
• join resource paths to an issuer with a trailing slash (c4b6524)
• keep the query string of static login and consent pages (c4be3b2)
• pass a copy of the scopes to getOidcClaims (c296c6e)
• reject a negative --hours in sesame:purge (5d48a4d)
• split comma-separated list flags in sesame:client (0cd9ec6)
• support Kysely connections using CamelCasePlugin (49f1592)
• validate inherited scopes on refresh against the server config (a416350)

Note: deployments whose issuer ends with / and that use guards with resource need users to authorize again, as resource identifiers no longer contain a double slash.

Release 0.9.0

0.9.0 (2026-10-29)

Bug Fixes

• keep publishing the JWKS while a signing key is configured (b91edfb)
• publish the JWKS and an audience for JWT access tokens (976f8ef)
• reject external-resource tokens at UserInfo (bf7e7cd)
• store the default audience of JWT access tokens (9551337)

Features

• accept external resource indicators (922f2ee)
• issue RFC 9068 JWT access tokens (5eb70db)
• support signing key rotation (fb2e945)

Release 0.8.1

0.8.1 (2026-10-22)

Bug Fixes

• allow matching body client_id with HTTP Basic authentication (#9) (51546f0)

Release 0.8.0

0.8.0 (2026-10-09)

Bug Fixes

• accept any port for loopback redirect URIs (eadae01)
• accept built-in scopes in authorization decisions (c5f3f51)
• account for response age when caching client metadata documents (f09b75a)
• adopt legacy credentials and lock grants during issuance (505b7eb)
• always show the consent page to metadata document clients (d881c4e)
• answer invalid_client when a client is deleted mid-authorization (7fefddf)
• block IPv4-compatible IPv6 addresses (33b1f0b)
• check grant state in introspection and userinfo (cd9124d)
• clarify OIDC scope errors (228c13a)
• compare client ids exactly on case-insensitive stores (79a9fd3)
• delete explicitly revoked refresh tokens so the grace period cannot revive them (7ed5722)
• enforce allowed hosts on every endpoint (052c8b9)
• hide fetch errors and cache anonymous metadata document resolutions (0181913)
• ignore grant ids that are not uuids (9f8d77e)
• ignore inherited properties when checking cimd auth methods (58b7f0c)
• keep custom metadata when refreshing metadata document clients (6e6b839)
• keep refresh tokens working on concurrent and cross-upgrade retries (d4eaee6)
• match guard audience like the resource parameter (2bae494)
• never purge client id metadata document clients (9883b7a)
• never purge clients that were authorized once (20fc967)
• never skip consent for public clients with loopback or custom scheme redirects (ebf72b4)
• no grace period for refresh tokens rotated before grants (5631797)
• normalize and revalidate granted scopes (907987f)
• publish lucid migration stubs with a destination (e18c576)
• reject unsafe characters in resource indicators (df5e95e)
• rewrite scope challenge on repeated guard calls (e02772b)
• use exact client id lookups in client management (7872b18)
• validate unused client purge age (5b535d6)

Features

• add 0.8 upgrade migration stubs for resource columns (fbdfaa2)
• add approveAuthorization and denyAuthorization (0ee9641)
• add first-class oauth grants (8737f0a)
• add pending authorization request lookup (6ac45e5)
• add sesame:upgrade command with 0.8 grant migrations (410267b)
• advertise required scopes in bearer challenges (b0a26da)
• advertise scopes_supported in authorization server metadata (49ed2bb)
• bind tokens to the requested resource (RFC 8707) (a6e9274)
• check token audience in guards declaring a resource (513a1de)
• export the client metadata document fetcher (f47fe6e)
• expose access token identity on the oauth guard (9b390c8)
• let scope middleware use a per-resource guard (54ebc77)
• purge unused dynamically registered clients (90fa059)
• support client id metadata documents (7de7a7e)
• support prompt=none and prompt=consent (c3b8677)

v0.7.0

What's new

• Sésame now uses one configurable store, backed by the Lucid or Kysely driver or a custom SesameStore implementation.
• Kysely applications can use Sésame without Lucid. The installer provides a standalone migration for SQLite, PostgreSQL, and MySQL; tables are not created automatically.
• OAuth persistence and transactional token operations are handled through the store contract.

Breaking changes

• Existing applications must configure a store, for example store: stores.lucid().
• Lucid models moved to @julr/sesame/drivers/lucid, the Lucid user provider moved to @julr/sesame/guard/lucid, and public TypeScript types are imported from @julr/sesame/types.
• Client-management methods now return plain OAuthClientRecord values instead of Lucid model instances.
• @adonisjs/auth is now a required peer dependency.

Read the 0.6.0 to 0.7.0 migration guide before upgrading an existing application.

Full changelog

Release 0.6.0

0.6.0

Breaking Changes

refresh_token.access_token_id now stores a UUID instead of a SHA-256 hash

The access_token_id column in the oauth_refresh_tokens table previously stored the SHA-256 hash of the access token. It now stores the access token's UUID primary key. This affects how token revocation lookups are performed internally.

Migration required:

// database/migrations/xxxx_update_oauth_refresh_tokens_access_token_id.ts
import { BaseSchema } from '@adonisjs/lucid/schema'

export default class extends BaseSchema {
  async up() {
    // 1. Truncate existing refresh tokens (they will be re-issued on next auth)
    await this.db.rawQuery('DELETE FROM oauth_refresh_tokens')

    // 2. Change column type from string to uuid
    this.schema.alterTable('oauth_refresh_tokens', (table) => {
      table.uuid('access_token_id').notNullable().alter()
    })
  }

  async down() {
    this.schema.alterTable('oauth_refresh_tokens', (table) => {
      table.string('access_token_id').notNullable().alter()
    })
  }
}

Note: Existing refresh tokens are incompatible with the new format and must be cleared. Users will need to re-authenticate once after the migration. Refresh tokens have a max TTL of 30 days, so alternatively you can just change the column type and let old tokens expire naturally (they will fail gracefully with invalid_grant).

DCR default grant_types now includes refresh_token

Clients registered via Dynamic Client Registration (RFC 7591) without an explicit grant_types field now default to ['authorization_code', 'refresh_token'] instead of ['authorization_code'].

This is technically a behavior change: previously, dynamically registered clients had to explicitly request the refresh_token grant type. Most MCP clients (Claude Code, etc.) already do this, so the impact should be minimal. If you relied on the old default to prevent refresh token issuance for dynamic clients, you will need to handle this at the application level.

New Features

OIDC Support

Full OpenID Connect support with ID token issuance, /userinfo endpoint, and JWKS endpoint. Requires configuring a JWK and an OIDC user provider.

New ace command sesame:key to generate the required RSA JWK.

Two new nullable columns are required for OIDC nonce support:

// database/migrations/xxxx_add_nonce_to_oauth_tables.ts
import { BaseSchema } from '@adonisjs/lucid/schema'

export default class extends BaseSchema {
  async up() {
    this.schema.alterTable('oauth_authorization_codes', (table) => {
      table.string('nonce').nullable()
    })

    this.schema.alterTable('oauth_pending_authorization_requests', (table) => {
      table.string('nonce').nullable()
    })
  }

  async down() {
    this.schema.alterTable('oauth_authorization_codes', (table) => {
      table.dropColumn('nonce')
    })

    this.schema.alterTable('oauth_pending_authorization_requests', (table) => {
      table.dropColumn('nonce')
    })
  }
}

Note: These columns are only used when OIDC is enabled (jwk + oidcProvider configured). If you don't use OIDC, you should still add them to avoid runtime errors from the model.

Refresh Token Rotation Grace Period

New refreshTokenRotationGracePeriod config option (default: 120 seconds). Allows a recently-rotated refresh token to be reused within a short window instead of triggering replay-attack detection.

This fixes disconnection issues with MCP clients (Claude Code, etc.) where concurrent refresh attempts (proactive refresh + SDK 401 retry) caused the old refresh token to be replayed, nuking all tokens for that client.

Same approach as Auth0 ("reuse interval") and Cloudflare workers-oauth-provider ("previous token"). Set to 0 to disable and restore the previous strict behavior.

// config/sesame.ts
const sesameConfig = defineConfig({
  // ...
  refreshTokenRotationGracePeriod: 120, // seconds (default)
})

Client CRUD API & sesame:client command

Programmatic API for creating, updating, listing, and deleting OAuth clients. New sesame:client ace command for managing clients from the CLI.

Other Changes

• Export exceptions via @julr/sesame/exceptions subpath
• Support Lucid v21 and v22 in peer dependencies

Release 0.5.1

(2026-03-17)

Bug Fixes

• always issue refresh tokens and advertise offline_access in metadata (5a3b7ed)

Release 0.5.0

0.5.0 (2026-03-16)

Bug Fixes

• treat offline_access as a built-in scope to prevent token expiration (c18f32a)

Features

• add client_credentials grant for m2m authentication (427a7cc)

Release 0.4.0

(2026-03-03)

Bug Fixes

• adverttise 'none' auth method for instrospection and revoc endpoints (6e2e754)
• always forward resolved scopes to consent page URL (18d2695)
• reject requests usins multiple client auth methods (d8d55cc)
• relax client registration validation for CLI/MCP clients (cb112fd)
• use generic error message in oauth guard to prevent token state enumeration (a71fd5f)

Features

• initial working version (4169866)