verbb/auth

Added

• Add PKCE (S256) support for Salesforce OAuth authorization-code flows.
• Persist and restore League OAuth2 PKCE verifiers across the OAuth redirect for any provider that enables PKCE.

Added

• Add PKCE (S256) support for Salesforce OAuth authorization-code flows.
• Persist and restore League OAuth2 PKCE verifiers across the OAuth redirect for any provider that enables PKCE.

Fixed

• Fix OAuth 401 retries skipping token refresh for providers that omit access-token expiry (for example Salesforce), which caused repeated INVALID_SESSION_ID failures until reconnecting.

Fixed

• Fix OAuth 401 retries skipping token refresh for providers that omit access-token expiry (for example Salesforce), which caused repeated INVALID_SESSION_ID failures until reconnecting.

Fixed

• Fix client_credentials API requests discarding the request payload (empty body), introduced in 2.0.41.

Fixed

• Fix client_credentials API requests discarding the request payload (empty body), introduced in 2.0.41.

Fixed

• Fix client_credentials API requests sending an empty scope parameter for providers like Marketo that reject it.

Fixed

• Fix client_credentials API requests sending an empty scope parameter for providers like Marketo that reject it.

Fixed

• Fix Apple sign-in fatal when is_private_email claim is omitted from the id_token.

Fixed

• Fix Apple sign-in fatal when is_private_email claim is omitted from the id_token.

Changed

• Update lcobucci/jwt to support 5.x.

Changed

• Update lcobucci/jwt to support 5.x.

Fixed

• Fix RedirectUri::getCallbackUri() using a CP URL for detached installs (cpTrigger = null) when front-end login plugins expect a site URL.

Fixed

• Fix RedirectUri::getCallbackUri() using a CP URL for detached installs (cpTrigger = null) when front-end login plugins expect a site URL.

Fixed

• Fix intermittent 401 errors for OAuth integrations when multiple queue workers refresh the same token concurrently.
• Reload OAuth tokens from the database before refreshing and before retrying 401 responses.
• Improve logging when token refresh fails due to invalid_grant (rotated refresh tokens).

Fixed

• Fix intermittent 401 errors for OAuth integrations when multiple queue workers refresh the same token concurrently.
• Reload OAuth tokens from the database before refreshing and before retrying 401 responses.
• Improve logging when token refresh fails due to invalid_grant (rotated refresh tokens).

Fixed

• Update client_credentials clients handling of scopes.

Fixed

• Update client_credentials clients handling of scopes.

Changed

• Update pkceVerifier check logic.

Changed

• Update pkceVerifier check logic.

Added

• Add RedirectUri helper to assist with redirection handling.

Changed

• Update firebase/php-jwt to support 7.x.

Removed

• Remove direct paragonie/random-lib dependency and use native PHP randomness for Twitter PKCE verifier generation.

Fixed

• Update Marketo to use access_token params.

Fixed

• Fix client credentials based grants throwing an error for scopes for some providers.

Fixed

• Update Marketo to use client_credentials grant.

Fixed

• Fix Client Credentials grants to using getAccessTokenOptions() and scopes in request.

Fixed

• Fix GithubResourceOwner typing.

Fixed

• Fix Client Credentials grants to using getAccessTokenOptions() and scopes in request.
• Fix type error for AuthorizationUrlEvent.

Fixed

• Fix PSR autoloading issue for Procurios due to typo.

Added

• Add SuiteCRM provider.
• Add Procurios provider.
• Add Marketo provider.
• Add LiveChat provider.
• Add Intercom provider.
• Add HelpScout provider.
• Add Front provider.
• Add CleverReach provider.
• Add the ability for providers to modify the options for a request.

Fixed

• Fix a merge issue with AzureResourceOwner.

Added

• Add support for psr/http-message "^1.0 || ^2.0".
• Add Bluesky icon.

Added

• Add email for Azure provider resources for common scenarios.

Changed

• Update GitHub, GitLab and PayPal provider classes to be proper case.

Changed

• Update league/oauth2-client dependency with refresh token fix. Provides official compatibility with PHP 8.3+.

Fixed

• Fix OneCRM provider.

Changed

• Lock league/oauth2-client to 2.7.0 to prevent an issue with refresh token scopes on some providers.

Added

• Add Xero provider.
• Add CA domain to Zoho provider.

Fixed

• Update handling for getBaseApiUrl() when a token doesn’t yet exist.

Fixed

• Update handling for getBaseApiUrl() when a token doesn’t yet exist.
• Fix an error when logging error codes.

Fixed

• Fix an error when making a request with a query string, and refreshing an expired token in the same request.

Added

• Add Microsoft Entra provider.

Fixed

• Fix Constant Contact client not working.

Fixed

• Add conditional for Twitter code_verifier check to prevent errors when already supplied.
• Fix an error with token values not being typed correctly.

Fixed

• Fix an issue with the Generic provider.

Fixed

• Fix an issue with the Generic provider and duplicate baseApiUrl.

Added

• Add the ability to set baseApiUrl for providers as part of their config. This can be a string, or a callback function.

Fixed

• Fix Zoho base API URL not taking into account useDeveloper setting.

Changed

• Updated Amazon Cognito provider.

Fixed

• Fix an error for IdentityServer4 getBaseApiUrl().
• Fix an error for Fedex getBaseApiUrl().
• Fix errors for Amazon Cognito Provider. (thanks @lucbernard).

Added

• Add Amazon Cognito provider.

Fixed

• Fix an error with Azure/Entra with login approval.

Fixed

• Fix Slack provider not setting correct auth token for requests.

Fixed

• Fix LinkedIn client to support v2 API.

Fixed

• Fix LinkedIn client to support v2 API.
• Fix an error with URL generation for authenticated requests.
• Fix error handling for IdentityServer4 provider.

Fixed

• Fix an error with Google provider

Added

• Add improved session-storage and restoration between authorization and callback methods, to improve failed sessions in some cases.
• Add IdentityServer4 provider.

Changed

• Now requires PHP 8.2.0+.
• Now requires Craft 5.0.0+.

Fixed

• Fix Apple provider token.
• Fix an error with Spotify error handling.
• Fix some Salesforce provider settings.
• Fix namespace for IdentityServer4 provider.
• Fix an error with URL generation for authenticated requests.
• Fix error handling for IdentityServer4 provider.

Changed

• Update firebase/php-jwt to support 7.x.

Removed

• Remove direct paragonie/random-lib dependency and use native PHP randomness for Twitter PKCE verifier generation.

Fixed

• Fix Client Credentials grants to using getAccessTokenOptions() and scopes in request.

Fixed

• Fix GithubResourceOwner typing.

Fixed

• Fix Client Credentials grants to using getAccessTokenOptions() and scopes in request.
• Fix type error for AuthorizationUrlEvent.

Added

• Unlock league/oauth2-client from 2.7.0.

Added

• Add support for psr/http-message "^1.0 || ^2.0".

Added

• Add email for Azure provider resources for common scenarios.

Added

• Add Bluesky icon.

Changed

• Lock league/oauth2-client to 2.7.0 to prevent an issue with refresh token scopes on some providers.

Added

• Add Xero provider.
• Add CA domain to Zoho provider.

Fixed

• Fix an error with Microsoft Entra provider.

Added

• Add Microsoft Entra provider.