Issues

• renewClientRegistrationIfDue rewrites a client record that a concurrent request already renewed

  bug
  cloudflare/workers-oauth-provider#429 · Filter by author andromarcestf opened on Oct 29, 2026
  1

• Grant revocation is not final: KV eventual consistency plus exchange/refresh read-then-write can resurrect a deleted grant

  cloudflare/workers-oauth-provider#428 · Filter by author danieltroger opened on Oct 28, 2026

• DCR: negotiate supported grant types for clients declaring additional flows

  enhancement
  cloudflare/workers-oauth-provider#422 · Filter by author grmkris opened on Oct 25, 2026

• Authorization code can be exchanged twice under concurrent token requests

  cloudflare/workers-oauth-provider#420 · Filter by author fujimogn opened on Oct 24, 2026

• Token endpoint answers "Grant not found" for fresh codes because the grant read caches a negative lookup for up to 60s

  cloudflare/workers-oauth-provider#419 · Filter by author staugaard opened on Oct 22, 2026

• Public clients that send an empty or extra client_secret are rejected at /token after upgrading to 1.x

  bug
  cloudflare/workers-oauth-provider#404 · Filter by author ksinder opened on Oct 6, 2026
  

• Deprecate resolveExternalToken and ExternalTokenError in favour of the split API's validateToken

  enhancement
  cloudflare/workers-oauth-provider#382 · Filter by author mattzcarey opened on Sep 25, 2026
  

• Opaque access tokens should identify their issuer

  enhancement
  cloudflare/workers-oauth-provider#380 · Filter by author mattzcarey opened on Sep 25, 2026

• RFC: upstream OAuth client for proxy servers (beginUpstream/finishUpstream/refreshUpstream)

  enhancement
  cloudflare/workers-oauth-provider#336 · Filter by author mattzcarey opened on Sep 24, 2026
  1

  

• RFC: consent and upstream-state helpers for MCP proxy servers

  enhancement
  cloudflare/workers-oauth-provider#334 · Filter by author mattzcarey opened on Sep 24, 2026
  

• feat: pinned Client ID Metadata Documents (clientIdMetadataDocuments), upstreaming Sentry's patch

  enhancement
  cloudflare/workers-oauth-provider#333 · Filter by author mattzcarey opened on Sep 24, 2026
  1

• feat: support RFC 9068 JWT access tokens with JWKS key rotation

  enhancement
  cloudflare/workers-oauth-provider#278 · Filter by author mattzcarey opened on Jul 31, 2026

• feat: add a strict MCP 2026 authorization profile

  enhancement
  cloudflare/workers-oauth-provider#262 · Filter by author mattzcarey opened on Jul 29, 2026

• Refresh-token rotation state on KV is racy under concurrent refresh; consider DO-backed serialization or idempotent rotation

  enhancement
  cloudflare/workers-oauth-provider#214 · Filter by author ksinder opened on May 29, 2026
  3

• feat: DPoP support (RFC 9449) — proof-of-possession token binding

  cloudflare/workers-oauth-provider#191 · Filter by author Talador12 opened on Apr 9, 2026

• Allowing the previous refresh token makes RT rotation useless

  cloudflare/workers-oauth-provider#43 · Filter by author neilmadden-teya opened on Jun 6, 2025
  6