New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.14

v26.4.14​

Identity federation apps must send their own credentials to exchange a code​

The token endpoint now requires an OIDC identity federation app's own client_id and client_secret to exchange an authorization code issued for that app, whether or not the login used PKCE. The credentials can be sent in the request body or in an Authorization: Basic header.

Breaking changes​

An exchange for a federation app's code is refused with 401 invalid_client when it sends only a code_verifier, or authenticates with other credentials, such as an SSO connection's client ID and secret or client_id=dummy with CLIENT_SECRET_VERIFIER. Configure the client to send the federation app's client ID and secret, shown on the app in the admin portal. Codes for SSO connections and other clients are not affected.