oauth2_client

[5.0.0-alpha.0] - 2026/05/15

• Update flutter_web_auth_2 to 6.x alpha
• Remove dedicated web auth flow - instead, delegate everything to flutter_web_auth_2

[4.3.3] - 2026/08/07

• Allow flutter_secure_storage versions 11.x

[4.3.2] - 2026/05/07

• Add even more exception and stack trace infos

[4.3.1] - 2026/04/23

• Cleanup token handling
• Improve even more error messages

[4.3.0] - 2026/04/22

• Allow specifying a default http client in OAuth2Helper
• Allow specifying a dedicated http client in more functions

[4.2.5] - 2026/04/20

• Catch invalid_request errors in refreshToken (see also #13)

[4.2.4] - 2026/04/01

• Improve exceptions/errors

[4.2.3] - 2026/01/13

• Bump flutter_web_auth_2 to stable 5.x

• Bump flutter_secure_storage to stable 10.x

• Update dependency constraints
• Update and fix lints
• Remove unnecessary dependency on meta package

• Add support for optional parameters in revoke function

• Add TikTok OAuth 2.0 client
• Fix example
• Fix issues with HTTP Content-Type headers using a dirty workaround

• Update documentation properly
• Fix a few typos here and there
• Allow changing the client ID and client secret key names

• This package changed maintainer (to ThexXTURBOXx)
• Updated Dart SDK requirement to >=3.5.0 (it is the most common nowadays and basically required)
• Updated all dependencies (with breaking changes!)
• Migrate to web and add WASM support
• Allow send HTTP requests

• Updated dependencies
• Fix: Check for null value before casting scope to String (thanks xolf)
• Fix: Added support for the preferEphemeral behavior on android (thanks dlatikaynen)

• Updated dependencies (thanks Jason Held)
• Fix for LinkedInOAuth2Client client (thanks Abhishek-Khanal)

• Updated dependencies

• Added Twitter client
• Added Microsoft client (thanks Eradparvar).

• Updated dependencies
• Small fixes

• Migrated to flutter_web_auth_2 (thanks ThexXTURBOXx & Piotr Mitkowski).
• Migrated to flutter_lints (thanks ThexXTURBOXx).
• Updated flutter_secure_storage
• Constants are now in lowerCamelCase
• Removed the OAuth2Client.accessTokenRequestHeaders class field. Use the proper getTokenWithAuthCodeFlow/getTokenWithClientCredentialsFlow parameters instead (see upgrading notes in the README).

• Fix for breaking change in flutter_secure_storage (thanks asmith26)

• Fix accessing secure token storage on newer Android versions (thanks Piotr Mitkowski).
• Added custom params handling for Implicit grant flow (thanks qasim90)

• Fix for token renewal process through the refresh token flow
• Expose the TokenStorage class

• Expose the BaseStorage object (thanks Jon Salmon)
• Improved documentation for android Manifest modification (thanks supermar1010)
• Update flutter_web_auth dependency

• Fix: support fetching a new token when expired without a refresh token (thanks Tiernan)
• Updated dependencies (thanks Menelphor)
• Fix linter warnings

• Small fix

• Add Spotify client (thanks mauriciocartagena)
• Allow passing custom WebAuth class to OAuth2Helper (thanks Jon Salmon)

• Fix: null check operator in WebAuth class (thanks jakub-bacic)

• Allow passing optional parameters to web_auth "authenticate" method

• Fix for authorization url params encoding

• Support ephemeral sessions (thanks ThexXTURBOXx)
• Fixes (URI components encoding)

• Fixes (scope handling)

• Fixes (incorrect scope handling with implicit grant, send empty client secret if specified)
• Added Reddit client (thanks lavalleeale)

• Web platform support!

• AccessTokenResponse refactorization. It is now possible to retrieve custom response fields through the getRespField method
• Scopes separator can be configured with the OAuth2Client's scopeSeparator param

• Complete migration to sound null safety
• Updated dependencies

• Migration to null safety
• Deprecated OAuth2Helper.setAuthorizationParams method

• Add compatibility with http 0.13 (thanks bangfalse)
• Allow passing credentials location in request body or header (thanks sbu-WBT)
• Added Shopify client (thanks sbu-WBT)

• Fixes (make httpClient optional again in OAuth2Helper)

• Added PUT, PATCH and HEAD methods to the OAuth2Helper class

• Allows iOS token reading from storage when invoked in background task
• Small fixes

• Changed helper's token retrieval method

• Added "delete" request method to helper class
• OAuth requests refactorization
• Fixes (fallback token_type parameter value)

• Made "state" parameter optional
• Fixes (refreshToken)

• Add implicit grant flow

• Allow disabling PKCE when using OAuth2Helper

• Bugfixes (check "expires_in" parameter type)

• Bugfixes (add null-aware operators)

• Token storage fix when scopes are empty

• Revocation token fixes

• Small fixes

• scopes parameter become ooptional (as per the OAuth2 specs)
• custom query parameters sent back from the authorization code response can now be retrieved throught the AuthorizationCode.getQueryParam method
• added afterAuthorizationCodeCb callback to handle use cases for access token requests
• added custom params handling to the Authorization Code and the Access Token Requests

• Minor bugfixes.

• Handled situations in which no new refresh token is returned upon a refresh flow.

• Added revocation token ("logout") process
• Refresh token flow is more spec compliant
• Updated dependencies

• Bugfixes (optional scopes handling in the Access Token Response)

• Bugfixes (multiple scopes handling)

• Added trim for "scope" parameter