Dynamic client registration, the API scope catalogue tied to rights, and bearer tokens as scope-narrowed sessions for resource servers (ID5.2 / ID5.3)

Expédié: 15 novembre 2026 à 12:55 UTC
Auteur: Kamo
Commit: cc87602

- /api/security/oidc/register (RFC 7591): 404 unless the org's dcrMode is APPROVAL / AUTO_PUBLIC; PENDING + one approval notification, except a public loopback/https app in AUTO_PUBLIC; per-IP and per-org limits; audited - Connected Apps settings dcrMode + registrationUrl; discovery registration_endpoint only while on, API scopes in scopes_supported - oauthserver/scopes/ApiScopes: <area>.read|write -> RoleRightTypes; public /api/security/oidc/scopes; allowedScopes accept them - a code / refresh carries only the API scopes whose rights the member holds now (the grant keeps what they agreed to) - internal resource-session: the token's member, live rights narrowed to its scopes, never god, marked apiScope so no rights push or refresh widens it, <=10 min, reused per token; internal issuer-by-host for the MCP gateway

Tous les changements

Comme ce que vous voyez l'expédition?

Commencez avec le plan gratuit et lisez à nouveau cette page dans un mois, puis passez à l’abonnement payant pour bénéficier de toutes les fonctionnalités.

Commencez gratuitement pour toujours Voir la tarification