v0.6.3

• chore: release v0.6.3
• Per-client OAuth scope restrictions (#34)
• Document the current auth system (authentication.md + README) (#32)
• Restore uniform refresh-token reuse detection under client binding (#33)
• Bind refresh tokens to their issuing client (#29)
• Close the async refresh-token rotation race (#31)
• Resource-bound tokens, issuer, scope catalog and PKCE method policy (#27)

v0.6.2

• chore: release v0.6.2
• Fix model auth lookup and release workflow (#25)

v0.6.1

• chore: release v0.6.1
• Publish to PyPI from bin/release.sh like fastapi-startkit (#26)

What's Changed

• Publish to PyPI from bin/release.sh like fastapi-startkit by @tmgbedu in #26

Full Changelog: v0.6.0...v0.6.1

v0.6.0

Full Changelog: v0.5.0...v0.6.0

v0.5.0

What's Changed

• feat: cleanup by @tmgbedu in #16
• refactor: replace lazy _EXPORTS table with plain imports in package init by @tmgbedu in #18
• Prepare release pipeline and packaging metadata by @tmgbedu in #20
• Async providers, guards, grants and SQL stores by @tmgbedu in #21
• Restore bin/release.sh by @tmgbedu in #22
• Resolve owner provider per client, inline cheap is_active checks, warm up dummy hash by @tmgbedu in #23
• Replace raw SQL stores with ORM stores and migrations by @tmgbedu in #24

Full Changelog: v0.3.0...v0.5.0

v0.3.0

What's Changed

• Passport-style OAuth2/JWT auth package for the FastAPI startkit by @tmgbedu in #1
• Close password-reset throttle enumeration side-channel (#894) by @tmgbedu in #2
• Rename package fastapi-passport → fastapi-startkit-auth (#902) by @tmgbedu in #3
• test: consolidate duplicated PKCE helper and app builders into conftest fixtures by @tmgbedu in #5
• Prepare fastapi-startkit-auth for PyPI release by @tmgbedu in #4
• docs: add documentation site and docs link by @tmgbedu in #6
• Roadmap: sequenced plan for cookie, SPA, and API-token auth by @tmgbedu in #7
• docs: confirm framework provider:publish contract for auth:cors (#1500) by @tmgbedu in #8
• Phase 0: guard-driver registry refactor in AuthManager by @tmgbedu in #9
• Phase 1: Cookie/session authentication (Auth facade, SessionGuard, session middleware, in-memory + SQL stores) by @tmgbedu in #10
• Phase 2: SPA authentication + CSRF (csrf-cookie endpoint, double-submit middleware, provider:publish) by @tmgbedu in #11
• Phase 3: Sanctum-style API token authentication (TokenGuard, opaque tokens, in-memory + SQL stores) by @tmgbedu in #12
• Fix connection-vs-factory detection: raw sqlite3.Connection misfires callable() branch by @tmgbedu in #13
• Remove docs site entirely by @tmgbedu in #14
• Prepare v0.2.0 PyPI release (uv_build backend, release script) by @tmgbedu in #15

New Contributors

• @tmgbedu made their first contribution in #1

Full Changelog: https://github.com/fastapi-startkit/fastapi-startkit-auth/commits/v0.3.0