Dynamic client registration, the API scope catalogue tied to rights, and bearer tokens as scope-narrowed sessions for resource servers (ID5.2 / ID5.3)

Shipped: 15 Novemba 2026, 12:55 UTC
Author: Kamo
Commit: cc87602

- /api/security/oidc/register (RFC 7591): 404 unless the org's dcrMode is APPROVAL / AUTO_PUBLIC; PENDING + one approval notification, except a public loopback/https app in AUTO_PUBLIC; per-IP and per-org limits; audited - Connected Apps settings dcrMode + registrationUrl; discovery registration_endpoint only while on, API scopes in scopes_supported - oauthserver/scopes/ApiScopes: <area>.read|write -> RoleRightTypes; public /api/security/oidc/scopes; allowedScopes accept them - a code / refresh carries only the API scopes whose rights the member holds now (the grant keeps what they agreed to) - internal resource-session: the token's member, live rights narrowed to its scopes, never god, marked apiScope so no rights push or refresh widens it, <=10 min, reused per token; internal issuer-by-host for the MCP gateway

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing