oidc_core
A dart package containing models and helpers for OpenId Connect spec.
3.0.0
15K downloads/mo
#2450 most downloaded on pub.dev
Bdaya-Dev/oidc
What this package is like to depend on
Last release 22 days ago
01 Aug 2026
Ships fairly regularly
a new release about every 4 months
Nearly every release is documented
notes for 36 of 36 stable releases
Nothing withdrawn
no release was ever pulled
3 years old
36 releases · first in 2023
8 releases in the last 12 months
see the full history below
Release timeline
36 releases · Aug 2023 to Aug 2026Releases
latest 36-
3.0.001 Aug 2026Release notes
Open source →- FIX(oidc_web_core): surface the flow timeout as OidcException, not TimeoutException. (be6a5316)
- FIX(oidc_android): forward Map-valued raw intent extras instead of dropping them. (7ffda6a7)
- FIX(oidc_android): dismiss the Custom Tab after the intent-filter redirect. (34a83693)
- DOCS(test): state the wiring guard's single-layer scope. (e25e04b8)
- BREAKING FIX(oidc_android): report the options the Auth Tab path cannot apply. (8b7226ce)
- BREAKING FIX(oidc_android): apply the documented Custom Tabs options natively. (9e83a10b)
Release notes
Open source →Note: This release has breaking changes.
- FIX(oidc_core): allow valid multi-audience ID tokens by default (#441). (f50cd755)
- FIX(oidc_core): log offline userinfo failures as WARNING, not SEVERE (#440). (c3b01b73)
- FIX(oidc_core): reject
code-only in loginHybridFlow, and stop overclaiming front-channel safety. (cedaf1af) - FEAT(oidc_core): manager-level dynamic client registration (RFC 7591). (fe4b4c4e)
- FEAT(oidc_core): implement WebFinger issuer discovery (OIDC Discovery §2, RFC 7033). (213657b8)
- FEAT(oidc_core): add loginHybridFlow (OIDC Core §3.3). (9afa3159)
- FEAT(oidc_core,oidc_web_core): bound the interactive web flow with flowTimeoutSeconds. (7282efa0)
- BREAKING FIX(oidc_core): never take the PKCE code_verifier from the authorization response (#404). (9a6006e0)
- BREAKING FIX(oidc_core): drop the legacy in-payload code_verifier fallback (#404). (a0c991c5)
- BREAKING FIX(oidc_core): the REGISTERED token_endpoint_auth_method wins over the caller's. (262bdfd4)
- BREAKING FIX(oidc_android): report the options the Auth Tab path cannot apply. (8b7226ce)
-
2.1.025 Jul 2026Release notes
Open source →- FEAT(oidc_core): silent-acquisition API at the manager/app boundary (#421, #422, #423, #424) (#425). (97ac60e6)
2026-07-14
Changes
Packages with breaking changes:
Packages with other changes:
oidc_cli-v1.0.1oidc_darwin-v1.1.0oidc_default_store-v1.1.0oidc_web_core-v1.1.0oidc_android-v1.0.1oidc_desktop-v1.0.1oidc_linux-v1.0.1oidc_platform_interface-v1.0.1oidc_web-v1.0.1oidc_windows-v1.0.1
Packages with dependency updates only:
Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.
oidc_android-v1.0.1oidc_desktop-v1.0.1oidc_linux-v1.0.1oidc_platform_interface-v1.0.1oidc_web-v1.0.1oidc_windows-v1.0.1
-
2.0.014 Jul 2026Release notes
Open source →Note: This release has breaking changes.
- FIX(oidc_core): protect the PKCE code_verifier at rest (#324 item 20) (#402). (32f4cbb3)
- FIX(oidc_core): route deleteClientConfiguration through typed error parsing (#400). (bd250ff5)
- FIX(oidc_core): honor expectedIssuer in validateUser (Entra multi-tenant) (#389). (4abc4e74)
- FIX(oidc_core): send dpop_jkt on the direct authorization request (#324) (#391). (c5e7420a)
- FEAT(oidc_core): mTLS RFC 8705 phase 1 core surface (#386) (#412). (f9b1446b)
- FEAT(oidc_core): DCR integration helpers (#385) (#413). (c07e881a)
- FEAT(oidc_core): react to a UserInfo 401 during session resume (#302) (#403). (933e0ed7)
- FEAT(oidc_darwin): add macOS loopback system-browser navigation mode (#124) (#398). (a8d758f7)
- FEAT(oidc_core): emit OidcTokenRefreshFailedEvent on refresh failures; clamp the expiring-refire loop (#392). (0b581dff)
- BREAKING FEAT(oidc_core): cache-first init as the new default, discovery TTL cache, loaded-token validity controls (#399). (de3e2287)
-
1.0.013 Jul 2026Release notes
Open source →- FIX: resolve all four library bugs; drive honest unit coverage to ~95% (#368). (c86bee17)
- FIX(crypto_keys_plus): resolve pub.dev publish dry-run warnings. (5bee9a89)
- FEAT(crypto): RSASSA-PSS (PS256/384/512) + EdDSA/Ed25519. (6c5c6741)
- BREAKING FEAT: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. (3fffc6cd)
Release notes
Open source →Note: This release has breaking changes.
- FIX(oidc_core): also ungate AUTO refresh-on-expiry from grant_types_supported (#324). (7e543b98)
- FIX: update packages/oidc_core/lib/src/managers/user_manager_base.dart. (d62828c0)
- FIX(oidc_core): kid-miss refetch on the cacheStore-less verification path. (8eecbe28)
- FIX(oidc_core): refetch JWKS on unknown kid with per-issuer cooldown. (badeba7b)
- FIX(oidc_core): single-location client auth on token exchange and introspection (RFC 6749 §2.3). (36f67e39)
- FIX(oidc_core): validate RFC 9207 iss on authorization error responses. (5916b65e)
- FIX(oidc_core): always send id_token_hint on RP-initiated logout. (434af9ab)
- FIX(oidc_core): reject UserInfo responses missing sub (OIDC Core §5.3.2). (f133c5b2)
- FIX(oidc_core): send client auth in exactly one location on refresh (RFC 6749 §2.3). (f6bf79a8)
- FIX(oidc_core): percent-encode client_secret_basic credentials (RFC 6749 §2.3.1). (94964778)
- FIX(oidc_darwin): implement flowTimeoutSeconds for the Apple ASWebAuthenticationSession flow. (482f0186)
- FIX: handle whitespace-only payloads. (2751b841)
- FIX(oidc_core): strip terminating slash when building well-known URL (#324). (975d446f)
- FIX: resolve all four library bugs; drive honest unit coverage to ~95% (#368). (c86bee17)
- FIX(oidc_core): close 7 P0 spec-audit findings (#324). (60907e96)
- FIX: handle refresh responses without id_token. (4af363be)
- FIX(oidc_core): restore web/WASM compatibility for offline error handling. (0c2e894a)
- FIX(core): harden DPoP thumbprint + JARM verification (adversarial-review fixes). (69ac51aa)
- FIX(core): DPoP — pad short EC coordinates (RFC 7638 jkt correctness). (bd5568e7)
- FIX(core): update device-code flow test for the fail-closed JWT default. (fa333f89)
- FIX: handle empty response. (03179667)
- FIX(oidc_core): harden ID-token/UserInfo validation (P0 spec-compliance). (1e7cfee9)
- FIX: pre-v1 correctness — certification claim, license, Android queries, honest native option docs. (3b8ef447)
- FEAT(oidc_core): deferred audit best-practice hardening (alg-pin, signed-userinfo, issuer, back-channel logout). (7259290d)
- FEAT(android): apply typed Custom Tabs options natively (Phase 1). (10e903eb)
- FEAT(oidc_core): enforce RFC 9207 iss require-when-advertised + error-path (#324). (3f324712)
- FEAT(core): JAR signed request objects + JARM signed responses (RFC 9101 / JARM). (19480489)
- FEAT(core): validate the Hybrid-flow front-channel id_token (OIDC Core §3.3.2). (8dbc582b)
- FEAT(core): Pushed Authorization Requests (PAR, RFC 9126) — endpoint + model. (6eb09f8a)
- FEAT(core): Token Introspection (RFC 7662) + step-up challenge parsing (RFC 9470). (ab0cdff0)
- FEAT(core): Resource Indicators (RFC 8707) + Token Exchange (RFC 8693). (43d8d664)
- FEAT(core): DPoP resource-endpoint nonce retry (RFC 9449 §9). (1d733790)
- FEAT(core): validate c_hash + auth_time/max_age (OIDC Core §3.3.2.11 / §3.1.2.1). (93c81845)
- FEAT(core): DPoP phase 3 — dpop_jkt auth-code binding + UserInfo DPoP scheme. (d28b736f)
- FEAT(core): DPoP phase 2 — use_dpop_nonce retry (centralized in the token endpoint). (bc059b27)
- FEAT(core): mint private_key_jwt / client_secret_jwt client assertions. (c7043fcc)
- FEAT(storage): harden token storage at rest (RFC 9700 §4.9.3). (76111b4a)
- FEAT(core): DPoP phase 1b — attach proofs to token-endpoint requests. (c0207476)
- FEAT(oidc): batch-2 audit hardening (loopback timeout, auth_time/max_age, resilient discovery parse, unverified-userinfo guard). (d7f5965a)
- FEAT(core): DPoP (RFC 9449) crypto core — proof builder + key/thumbprint + manager. (43f566d5)
- FEAT(oidc_core): batch-3 audit hardening (signed_metadata verify, JWKS cache TTL, implicit/hybrid nonce assert). (27a7f34d)
- FEAT(oidc_core): typed logout capability flags on provider metadata. (74a6613a)
- FEAT(core): Dynamic Client Registration + management (RFC 7591 / RFC 7592). (55226655)
- FEAT(observability): native browser events via the existing OidcEvent stream (Phase 3). (91d1f5bd)
- BREAKING REFACTOR: remove rxdart; adopt bdaya_shared_value ^5.0.0. (0d65d7fd)
- BREAKING FIX(core): always send PKCE (default S256), never downgrade (OAuth 2.1 / RFC 9700). (99d1284a)
- BREAKING FIX(core): fail-closed id_token verification + stricter validation (security). (b4d92eaf)
- BREAKING FEAT(core): wire PAR (RFC 9126) into the authorization-code login flow. (d2b44c32)
- BREAKING FEAT(core): id_token aud-strictness + at_hash validation (security). (747d8a72)
- BREAKING FEAT(options): redesign native options API (v1 clean break, no AppAuth framing). (a78954fe)
- BREAKING FEAT: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. (3fffc6cd)
- BREAKING FEAT(core): revoke tokens on logout by default (RFC 7009). (90a8cebd)
- BREAKING FEAT(oidc_android): add flowTimeoutSeconds to fix headless CI hang. (01c844f5)
- BREAKING FEAT(oidc_core): remove the strictJwtVerification fail-open opt-out. (ee2146f9)
- BREAKING CHORE: v1 dependency upgrade + drop the pigeon global-tool wrapper. (45b62a3e)
-
0.16.110 Feb 2026Release notes
Open source →- FEAT(oidc_core): add extraTokenHeaders parameter to loginPassword. (e00c753b)
2025-12-31
Changes
Packages with breaking changes:
Packages with other changes:
oidc_cli-v0.0.2oidc_web_core-v0.4.0+1oidc_android-v0.8.0+1oidc_desktop-v0.7.0+1oidc_flutter_appauth-v0.7.0+1oidc_ios-v0.8.0+1oidc_linux-v0.5.0+1oidc_macos-v0.8.0+1oidc_platform_interface-v0.7.0+1oidc_web-v0.7.0+1oidc_windows-v0.4.0+1
Packages with dependency updates only:
Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.
oidc_android-v0.8.0+1oidc_desktop-v0.7.0+1oidc_flutter_appauth-v0.7.0+1oidc_ios-v0.8.0+1oidc_linux-v0.5.0+1oidc_macos-v0.8.0+1oidc_platform_interface-v0.7.0+1oidc_web-v0.7.0+1oidc_windows-v0.4.0+1
Release notes
Open source →- FEAT(oidc_core): add extraTokenHeaders parameter to loginPassword. (e00c753b)
-
0.16.1+110 Feb 2026 -
0.16.006 Feb 2026Release notes
Open source →- REFACTOR: remove unnecessary @protected annotations from offline mode tracking variables. (56da9bab)
- FEAT: update copy_with_extension and copy_with_extension_gen dependencies to support version range. (3569919e)
- FEAT: update dependencies and adjust test configurations for improved compatibility. (18fef073)
- FEAT: update dependencies and enhance offline mode test handling. (a57d6490)
- FEAT: enhance offline mode handling in tests and user manager. (e0cae79a)
- BREAKING FEAT: Add offline mode events and error handling. (7479fd15)
Release notes
Open source →Note: This release has breaking changes.
- REFACTOR: remove unnecessary @protected annotations from offline mode tracking variables. (56da9bab)
- FEAT: update copy_with_extension and copy_with_extension_gen dependencies to support version range. (3569919e)
- FEAT: update dependencies and adjust test configurations for improved compatibility. (18fef073)
- FEAT: update dependencies and enhance offline mode test handling. (a57d6490)
- FEAT: enhance offline mode handling in tests and user manager. (e0cae79a)
- BREAKING FEAT: Add offline mode events and error handling. (7479fd15)
-
0.15.010 Oct 2025 -
0.14.212 Jun 2025Release notes
Open source →- REFACTOR: remove unnecessary library declaration and test annotation from device_authorization_test.dart. (a8886cfe)
- FEAT: add token revocation methods to OidcUserManager. (4850788f)
- FEAT: add token revocation support with request and response models. (a6b635f0)
2025-06-12
Changes
Packages with breaking changes:
- There are no breaking changes in this release.
Packages with other changes:
oidc-v0.12.1oidc_core-v0.14.1oidc_desktop-v0.6.1oidc_linux-v0.4.1oidc_android-v0.7.0+3oidc_default_store-v0.4.0+1oidc_ios-v0.7.0+3oidc_flutter_appauth-v0.6.0+3oidc_macos-v0.7.0+3oidc_platform_interface-v0.6.0+7oidc_web_core-v0.3.1+1oidc_web-v0.6.0+7oidc_windows-v0.3.1+12
Packages with dependency updates only:
Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.
oidc_android-v0.7.0+3oidc_default_store-v0.4.0+1oidc_ios-v0.7.0+3oidc_flutter_appauth-v0.6.0+3oidc_macos-v0.7.0+3oidc_platform_interface-v0.6.0+7oidc_web_core-v0.3.1+1oidc_web-v0.6.0+7oidc_windows-v0.3.1+12
-
0.14.2+114 Jun 2025 -
0.14.112 Jun 2025Release notes
Open source →- FEAT: update changelogs to reflect breaking changes and new features for multiple OIDC platforms. (4caca121)
-
0.14.012 Jun 2025Release notes
Open source →- FEAT: improve offline mode integration tests with app startup handling. (18a586c9)
- FEAT: update dependencies and enhance offline mode test handling. (a57d6490)
- FEAT: enhance offline mode handling in tests and user manager. (e0cae79a)
- BREAKING FEAT(oidc_default_store): use flutter_secure_storage. (a9441511)
- BREAKING FEAT: Add offline mode events and error handling. (7479fd15)
Release notes
Open source →- BREAKING FEAT: Added
launchUrlparameter toOidcPlatformSpecificOptions_Native, to simplify modifying the url launching logic without overriding the manager.- BREAKING FEAT: Added support for multiple managers by adding the
idproperty toOidcUserManagerBase.- Added the
managerIdparameter to:- Multiple methods in
OidcStore. OidcState
- Multiple methods in
- See #206 for motivation.
- Added the
- FIX: Added some missing fields in json serialization.
- BREAKING FEAT: Added support for multiple managers by adding the
-
0.13.007 Jun 2025Release notes
Open source → -
0.12.016 Apr 2025 -
0.11.013 Apr 2025 -
0.10.012 Apr 2025 -
0.9.127 Nov 2024Release notes
Open source →2024-11-24
Changes
Packages with breaking changes:
oidc-v0.9.0oidc_android-v0.6.0oidc_core-v0.9.0oidc_desktop-v0.5.0oidc_flutter_appauth-v0.5.0oidc_ios-v0.6.0oidc_macos-v0.6.0oidc_platform_interface-v0.6.0oidc_web-v0.6.0oidc_web_core-v0.3.0
Packages with other changes:
Packages with dependency updates only:
Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.
oidc_default_store-v0.2.0+11oidc_windows-v0.3.1+5oidc_linux-v0.3.0+11
Release notes
Open source → -
0.9.024 Nov 2024Release notes
Open source →Note: This release has breaking changes.
- FIX: expand successful status range to include 300-399 status code to allow for 304 , see. (717d5330)
- FIX: improve OidcEndpoints error handling. (5f15c774)
- FIX: update oidc_web_core version. (2717b23c)
- FEAT: support offline auth. (cced6013)
- FEAT: add keepUnverifiedTokens and keepExpiredTokens to user manager settings. (117931bd)
- FEAT: add getIdToken to OidcUserManagerSettings. (dceabc89)
- FEAT: updated oidc_core example. (676657b1)
- DOCS: update changelogs. (b0ffeb43)
- BREAKING FIX: Opening in new tab not working reliably in Safari for iOS #31. (2e30028b)
-
0.7.009 Jun 2024Release notes
Open source →Note: This release has breaking changes.
- BREAKING DEPS: update min dart version to 3.4.0
- FEAT: added
OidcUserManagerBase. - FIX: improve
OidcEndpointserror handling. - DOCS: updated the docs website with new entries to the added features.
-
0.6.320 Mar 2024Release notes
Open source →- DEPS: Use
jose_plus: ^0.4.4which uses package:clock JWT validation to simplify testing. - FEAT: Added
OidcDateTimeextension which containssecondsSinceEpochandfromSecondsSinceEpochhelper methods
- DEPS: Use
-
0.6.213 Mar 2024Release notes
Open source →- FIX: Serialize query parameters.
- FIX: Removed false positive warnings that came from url_launcher
-
0.6.101 Mar 2024Release notes
Open source →- FEAT: update changelogs to reflect breaking changes and new features for multiple OIDC platforms. (4caca121)
-
0.6.025 Sep 2023Release notes
Open source →Note: This release has breaking changes.
- FEAT: added claimNames and claimSources to OidcUserInfoResponse.
- BREAKING CHANGE: changed nonce to get stored in secureTokens namespace.
-
0.6.0+115 Oct 2023 -
0.5.119 Sep 2023 -
0.5.018 Sep 2023 -
0.5.0+119 Sep 2023Release notes
Open source →- FIX: added
userInfotofromIdToken. - DOCS: added oidc_core docs and updated example.
- FIX: added
-
0.4.116 Sep 2023Release notes
Open source →- FEAT: update changelogs to reflect breaking changes and new features for multiple OIDC platforms. (4caca121)
Change Log
All notable changes to this project will be documented in this file. See Conventional Commits for commit guidelines.
2025-06-12
Changes
Packages with breaking changes:
Packages with other changes:
oidc-v0.12.0oidc_core-v0.14.0oidc_default_store-v0.4.0oidc_desktop-v0.6.0oidc_web_core-v0.3.1oidc_android-v0.7.0+2oidc_flutter_appauth-v0.6.0+2oidc_ios-v0.7.0+2oidc_macos-v0.7.0+2oidc_platform_interface-v0.6.0+6oidc_web-v0.6.0+6oidc_windows-v0.3.1+11
Packages with dependency updates only:
Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.
oidc_android-v0.7.0+2oidc_flutter_appauth-v0.6.0+2oidc_ios-v0.7.0+2oidc_macos-v0.7.0+2oidc_platform_interface-v0.6.0+6oidc_web-v0.6.0+6oidc_windows-v0.3.1+11
Release notes
Open source →- FEAT: add response form userInfo endpoint to the user object.
- FEAT: use package:clock for better testing.
-
0.4.015 Sep 2023 -
0.4.0+116 Sep 2023Release notes
Open source →- FIX(oidc_web_core): use isA() for JS interop checks. (724c9a2a)
2025-10-10
Changes
Packages with breaking changes:
oidc-v0.13.0oidc_android-v0.8.0oidc_core-v0.15.0oidc_default_store-v0.5.0oidc_desktop-v0.7.0oidc_flutter_appauth-v0.7.0oidc_ios-v0.8.0oidc_linux-v0.5.0oidc_loopback_listener-v0.3.0oidc_macos-v0.8.0oidc_platform_interface-v0.7.0oidc_web-v0.7.0oidc_web_core-v0.4.0oidc_windows-v0.4.0
Packages with other changes:
- There are no other changes in this release.
-
0.3.212 Sep 2023 -
0.3.109 Sep 2023Release notes
Open source →- FEAT: Enhance OIDC store with manager ID support. (56f42f2d)
Change Log
All notable changes to this project will be documented in this file. See Conventional Commits for commit guidelines.
2025-06-06
Changes
Packages with breaking changes:
Packages with other changes:
oidc_web_core-v0.3.0+5oidc_desktop-v0.5.0+5oidc_ios-v0.7.0+1oidc_platform_interface-v0.6.0+5oidc_macos-v0.7.0+1oidc_android-v0.7.0+1oidc_web-v0.6.0+5oidc_linux-v0.3.0+16oidc_flutter_appauth-v0.6.0+1oidc_windows-v0.3.1+10
Packages with dependency updates only:
Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.
oidc_web_core-v0.3.0+5oidc_desktop-v0.5.0+5oidc_ios-v0.7.0+1oidc_platform_interface-v0.6.0+5oidc_macos-v0.7.0+1oidc_android-v0.7.0+1oidc_web-v0.6.0+5oidc_linux-v0.3.0+16oidc_flutter_appauth-v0.6.0+1oidc_windows-v0.3.1+10
-
0.3.008 Sep 2023 -
0.2.004 Sep 2023 -
0.1.024 Aug 2023 -
0.1.0+124 Aug 2023