Skip to main content

v26.3.5

v26.3.5​

Add oauth2.grant_types_disabled config key​

Ory Hydra's configuration schema now supports oauth2.grant_types_disabled: a list of OAuth 2.0 grant type identifiers clients may not be registered with. An absent or empty list disables nothing, so deployments that never set the key are unaffected.

The key can only disable grant types; it cannot enable grant types the server does not implement. In particular, the Resource Owner Password Credentials grant remains unavailable in Ory Hydra OSS — it is implemented only in Ory Network and Ory Enterprise License (OEL) deployments.

Registering a new client with a disabled grant type, or adding a disabled grant type to an existing client, is rejected with invalid_client_metadata (HTTP 400). Clients that already carry the grant type are unaffected: they keep working at runtime and remain fully maintainable through the API — updates, secret rotation, and lifespan changes still succeed.

Disabled grant types are also omitted from grant_types_supported in the OpenID Connect discovery and OAuth 2.0 authorization server metadata documents, so new integrations only see grant types they can register.

Hydra warns at startup about list entries that do not match a registered OAuth 2.0 grant type and are not custom extension grant URIs — for example device_code instead of urn:ietf:params:oauth:grant-type:device_code, or a misspelled grant type URN — since unknown entries disable nothing.

Set the key through an environment variable as a comma-separated list (OAUTH2_GRANT_TYPES_DISABLED='password,urn:ietf:params:oauth:grant-type:device_code') or as a JSON array.