@absolutejs/auth 0.78.0 → 0.79.0

package/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+All notable changes to `@absolutejs/auth`.
+
+This file is generated by `absolute-changelog` from the entries in
+`changelog/`. Edit an entry, not this file — and add new ones under
+`changelog/unreleased/`.
+
+## 0.79.0 — 2026-09-10
+
+### Breaking
+
+- **Separate API credential token routes from OIDC and reject conflicting configuration** (`apiKeysRoutes`, `auth`, `createAuthApplications`, `AuthConfig`, `ApiKeysConfig`)
+  _Migration:_ Send client_credentials requests to /auth/api/token instead of /oauth2/token and update advertised enterprise token URLs. Keep authorization_code and refresh_token requests at /oauth2/token. Prefer auth({ oidc, apikeys }) for configuration validation. API-only consumers may explicitly keep tokenRoute: /oauth2/token if no OIDC handler uses that path.

package/README.md

@@ -392,3 +392,19 @@ using it has expired; duplicate key IDs fail closed.
 ## Note
 
 This project uses Bun and is built for Elysia.
+
+## OAuth and API credential token routes
+
+As of 0.79.0, `apiKeysRoutes()` and `auth({ apikeys })` serve the
+`client_credentials` grant at `/auth/api/token` by default. OIDC authorization
+code and refresh grants continue to use `/oauth2/token`. This keeps separately
+mounted plugins from replacing each other's token handler.
+
+Update enterprise integrations and displayed token URLs to `/auth/api/token`.
+API-only applications can retain the previous URL by explicitly setting
+`apikeys.tokenRoute: '/oauth2/token'`, provided no OIDC handler uses that path.
+
+Prefer configuring both features in `auth({ oidc, apikeys })`: conflicting token
+paths are rejected during construction, including a trailing-slash alias.
+When mounting standalone plugins with custom paths, the consumer must keep
+the paths distinct; Elysia does not reject arbitrary duplicate routes.

package/changelog.json

@@ -0,0 +1,27 @@
+{
+	"contract": 1,
+	"name": "@absolutejs/auth",
+	"releases": [
+		{
+			"changes": [
+				{
+					"kind": "breaking",
+					"migration": {
+						"instruction": "Send client_credentials requests to /auth/api/token instead of /oauth2/token and update advertised enterprise token URLs. Keep authorization_code and refresh_token requests at /oauth2/token. Prefer auth({ oidc, apikeys }) for configuration validation. API-only consumers may explicitly keep tokenRoute: /oauth2/token if no OIDC handler uses that path.",
+						"manual": true
+					},
+					"summary": "Separate API credential token routes from OIDC and reject conflicting configuration",
+					"symbols": [
+						"apiKeysRoutes",
+						"auth",
+						"createAuthApplications",
+						"AuthConfig",
+						"ApiKeysConfig"
+					]
+				}
+			],
+			"date": "2026-09-10",
+			"version": "0.79.0"
+		}
+	]
+}

package/dist/apikeys/config.d.ts

@@ -13,7 +13,7 @@ export type ApiKeysConfig = {
     /** Static API keys. Used by the exported `verifyApiKey` / `resolveApiPrincipal`
      *  helpers; the consumer wires its own management + guard routes. */
     apiKeyStore?: ApiKeyStore;
-    /** Path of the client_credentials token endpoint (defaults to `/oauth2/token`). */
+    /** Path of the client_credentials token endpoint (defaults to `/auth/api/token`). */
     tokenRoute?: RouteString;
 };
 export type ClientCredentialsResult = {

package/dist/apikeys/tokenRoutes.d.ts

@@ -0,0 +1,7 @@
+import type { RouteString } from '../types';
+import { type ApiKeysConfig } from './config';
+/** Elysia replaces duplicate method/path registrations. Refuse that setup
+ * before composing the two independently configured token handlers. */
+export declare const assertTokenRouteConfiguration: (apikeys: ApiKeysConfig | undefined, oidc: {
+    oidcRoute?: RouteString;
+} | undefined) => void;