New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.12

v26.4.12​

Token lifespans are administrator-only for dynamically registered clients​

OpenID Connect Dynamic Client Registration no longer accepts per-client token lifespans. POST /oauth2/register and PUT /oauth2/register/{id} reject a request that sets one with invalid_client_metadata. The registration endpoints also no longer return the lifespan fields, so a registration client can read its own registration and send it back unchanged, as RFC 7592 prescribes.

A lifespan an administrator set with PUT /admin/clients/{id}/lifespans now stays in place when the client updates its own registration. Before, such an update cleared it.

The deployment ttl settings are unchanged. They remain the defaults for clients that set no override.

Breaking changes​

A dynamic client registration request that sends a token lifespan field now fails. Remove the lifespan fields from dynamic registration payloads and set them with PUT /admin/clients/{id}/lifespans instead.