@faable/auth-sdk 2.9.8 → 2.9.10

package/dist/FaableAuthApi.d.ts

@@ -104,6 +104,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;

package/dist/api/generated-client.d.ts

@@ -103,6 +103,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;
@@ -189,6 +190,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;
@@ -295,6 +297,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;
@@ -384,6 +387,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;
@@ -521,6 +525,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             webauthn_rp_id?: string | null | undefined;
             logout_confirm_required?: boolean | undefined;
             dynamic_client_registration_enabled?: boolean | undefined;
+            oauth21_enabled?: boolean | undefined;
             client_id_metadata_documents_enabled?: boolean | undefined;
             canonical_host?: string | null | undefined;
             createdAt: string;
@@ -591,6 +596,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             webauthn_rp_id?: string | null | undefined;
             logout_confirm_required?: boolean | undefined;
             dynamic_client_registration_enabled?: boolean | undefined;
+            oauth21_enabled?: boolean | undefined;
             client_id_metadata_documents_enabled?: boolean | undefined;
             canonical_host?: string | null | undefined;
             createdAt: string;
@@ -664,6 +670,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             webauthn_rp_id?: string | null | undefined;
             logout_confirm_required?: boolean | undefined;
             dynamic_client_registration_enabled?: boolean | undefined;
+            oauth21_enabled?: boolean | undefined;
             client_id_metadata_documents_enabled?: boolean | undefined;
             canonical_host?: string | null | undefined;
             createdAt: string;
@@ -929,6 +936,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;

package/dist/api/types.d.ts

@@ -5808,6 +5808,8 @@ export interface components {
             logout_confirm_required?: boolean;
             /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
             dynamic_client_registration_enabled?: boolean;
+            /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+            oauth21_enabled?: boolean;
             /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
             client_id_metadata_documents_enabled?: boolean;
             /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -8534,6 +8536,7 @@ export interface components {
             logout_confirm_required?: boolean | null;
             dynamic_client_registration_enabled?: boolean | null;
             client_id_metadata_documents_enabled?: boolean | null;
+            oauth21_enabled?: boolean | null;
             canonical_host?: string | null;
             login_flow?: string | null;
         };
@@ -8585,6 +8588,10 @@ export interface components {
             /** @description An opaque value the applications adds to the initial request that the authorization server includes when redirecting the back to the application. This value must be used by the application to prevent CSRF attacks. */
             state?: string;
             response_type?: string;
+            /** @description PKCE challenge, without a `state` only. */
+            code_challenge?: string;
+            /** @description Only `S256` is supported. */
+            code_challenge_method?: string;
             /** @description Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored. */
             redirect_to?: string;
             /** @description The "Remember me on this device" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: "optional"`): `true` keeps the session for `remember_me_days`, `false` ends it when the browser closes. */
@@ -8755,6 +8762,7 @@ export interface components {
          *     - `not_a_member` (404): The user is not a member of the team.
          *     - `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.
          *     - `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.
+         *     - `oauth21_required` (400): The tenant enforces OAuth 2.1 (`oauth21_enabled`) and the request is one OAuth 2.1 removed: a `response_type` other than `code`, an authorization request without PKCE (`code_challenge` with `S256`), or the password grant. `message` says which. Update the application (with `@faable/auth-js`, version 3.1.0 or later) or turn `oauth21_enabled` off for the tenant.
          *     - `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.
          *     - `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.
          *     - `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.
@@ -8783,7 +8791,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "last_sign_in_method" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "invalid_saml_request" | "saml_sp_mismatch" | "saml_not_enabled" | "invalid_saml_sp" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "reauth_required" | "invalid_current_password" | "email_not_verified" | "invalid_profile_field" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "invalid_permission" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "last_sign_in_method" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "invalid_saml_request" | "saml_sp_mismatch" | "saml_not_enabled" | "invalid_saml_sp" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "reauth_required" | "invalid_current_password" | "email_not_verified" | "invalid_profile_field" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "oauth21_required" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "invalid_permission" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -8956,6 +8964,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -9326,6 +9336,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -9584,6 +9596,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -9791,6 +9805,7 @@ export interface operations {
                     logout_confirm_required?: boolean | null;
                     dynamic_client_registration_enabled?: boolean | null;
                     client_id_metadata_documents_enabled?: boolean | null;
+                    oauth21_enabled?: boolean | null;
                     canonical_host?: string | null;
                     login_flow?: string | null;
                 };
@@ -9930,6 +9945,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -11311,6 +11328,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -37316,6 +37335,10 @@ export interface operations {
                     /** @description An opaque value the applications adds to the initial request that the authorization server includes when redirecting the back to the application. This value must be used by the application to prevent CSRF attacks. */
                     state?: string;
                     response_type?: string;
+                    /** @description PKCE challenge, without a `state` only. */
+                    code_challenge?: string;
+                    /** @description Only `S256` is supported. */
+                    code_challenge_method?: string;
                     /** @description Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored. */
                     redirect_to?: string;
                     /** @description The "Remember me on this device" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: "optional"`): `true` keeps the session for `remember_me_days`, `false` ends it when the browser closes. */
@@ -37363,6 +37386,10 @@ export interface operations {
              *
              *     `invalid_credentials` — The email/username or password is incorrect.
              *
+             *     `invalid_request` — A required OAuth parameter is missing or two of them are incompatible. `message` says which.
+             *
+             *     `oauth21_required` — The tenant enforces OAuth 2.1 (`oauth21_enabled`) and the request is one OAuth 2.1 removed: a `response_type` other than `code`, an authorization request without PKCE (`code_challenge` with `S256`), or the password grant. `message` says which. Update the application (with `@faable/auth-js`, version 3.1.0 or later) or turn `oauth21_enabled` off for the tenant.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -37372,7 +37399,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_code" | "invalid_connection" | "invalid_credentials" | "validation_error";
+                        error_code?: "invalid_code" | "invalid_connection" | "invalid_credentials" | "invalid_request" | "oauth21_required" | "validation_error";
                     };
                 };
             };

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.9.8";
+export const version = "2.9.10";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "c5244b8";
+export const commit = "048d40a";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.9.8",
+  "version": "2.9.10",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.96.2",
+    "version": "2.98.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -591,6 +591,10 @@
             "type": "boolean",
             "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
           },
+          "oauth21_enabled": {
+            "type": "boolean",
+            "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+          },
           "client_id_metadata_documents_enabled": {
             "type": "boolean",
             "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -9374,6 +9378,10 @@
             "type": "boolean",
             "nullable": true
           },
+          "oauth21_enabled": {
+            "type": "boolean",
+            "nullable": true
+          },
           "canonical_host": {
             "type": "string",
             "nullable": true
@@ -9619,6 +9627,14 @@
           "response_type": {
             "type": "string"
           },
+          "code_challenge": {
+            "type": "string",
+            "description": "PKCE challenge, without a `state` only."
+          },
+          "code_challenge_method": {
+            "type": "string",
+            "description": "Only `S256` is supported."
+          },
           "redirect_to": {
             "type": "string",
             "description": "Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored."
@@ -9709,7 +9725,7 @@
       },
       "ErrorCode": {
         "type": "string",
-        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `last_sign_in_method` (409): Unlinking this account would leave the user with no way to sign in: set a password, verify the email or link another account first.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (403): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): A client field was rejected: by dynamic client registration (RFC 7591), or on a client create/update (`initiate_login_uri`). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `invalid_saml_request` (400): The SAMLRequest is missing, too large, not well-formed or not a SAML 2.0 AuthnRequest.\n- `saml_sp_mismatch` (400): The AuthnRequest does not match the client's SAML configuration: its Issuer is not the configured entity_id, or it asks for another Assertion Consumer Service URL or binding.\n- `saml_not_enabled` (404): This client does not have SAML enabled.\n- `invalid_saml_sp` (400): The `saml_sp` configuration is invalid: `acs_url` must be an absolute https URL without a fragment.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `reauth_required` (403): The operation needs a recent sign-in (and the second factor, when the user has one). Sign in again with `max_age=0` and retry with the new token.\n- `invalid_current_password` (400): The current password is wrong.\n- `email_not_verified` (403): The user's email is not verified, and the operation needs it to be.\n- `invalid_profile_field` (400): A profile field is not declared for this application, or its value does not match the declaration. `message` names the key.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.\n- `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.\n- `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.\n- `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.\n- `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.\n- `organization_domain_not_found` (404): The organization has no such domain.\n- `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.\n- `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.\n- `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.\n- `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.\n- `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.\n- `organization_has_no_idp` (400): Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.\n- `organization_not_found` (404): No organization with that id in this account.\n- `invalid_user` (400): The user does not exist in this account.\n- `not_an_organization_admin` (404): The user is not an admin of the organization.\n- `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `invalid_permission` (400): A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.",
+        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `last_sign_in_method` (409): Unlinking this account would leave the user with no way to sign in: set a password, verify the email or link another account first.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (403): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): A client field was rejected: by dynamic client registration (RFC 7591), or on a client create/update (`initiate_login_uri`). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `invalid_saml_request` (400): The SAMLRequest is missing, too large, not well-formed or not a SAML 2.0 AuthnRequest.\n- `saml_sp_mismatch` (400): The AuthnRequest does not match the client's SAML configuration: its Issuer is not the configured entity_id, or it asks for another Assertion Consumer Service URL or binding.\n- `saml_not_enabled` (404): This client does not have SAML enabled.\n- `invalid_saml_sp` (400): The `saml_sp` configuration is invalid: `acs_url` must be an absolute https URL without a fragment.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `reauth_required` (403): The operation needs a recent sign-in (and the second factor, when the user has one). Sign in again with `max_age=0` and retry with the new token.\n- `invalid_current_password` (400): The current password is wrong.\n- `email_not_verified` (403): The user's email is not verified, and the operation needs it to be.\n- `invalid_profile_field` (400): A profile field is not declared for this application, or its value does not match the declaration. `message` names the key.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.\n- `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.\n- `oauth21_required` (400): The tenant enforces OAuth 2.1 (`oauth21_enabled`) and the request is one OAuth 2.1 removed: a `response_type` other than `code`, an authorization request without PKCE (`code_challenge` with `S256`), or the password grant. `message` says which. Update the application (with `@faable/auth-js`, version 3.1.0 or later) or turn `oauth21_enabled` off for the tenant.\n- `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.\n- `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.\n- `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.\n- `organization_domain_not_found` (404): The organization has no such domain.\n- `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.\n- `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.\n- `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.\n- `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.\n- `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.\n- `organization_has_no_idp` (400): Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.\n- `organization_not_found` (404): No organization with that id in this account.\n- `invalid_user` (400): The user does not exist in this account.\n- `not_an_organization_admin` (404): The user is not an admin of the organization.\n- `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `invalid_permission` (400): A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.",
         "enum": [
           "bad_request",
           "validation_error",
@@ -9840,6 +9856,7 @@
           "not_a_member",
           "consent_options_unavailable",
           "consent_choice_invalid",
+          "oauth21_required",
           "registration_disabled",
           "invalid_email_domain",
           "public_email_domain",
@@ -10577,6 +10594,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -11384,6 +11405,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -12428,6 +12453,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -13120,6 +13149,10 @@
                     "type": "boolean",
                     "nullable": true
                   },
+                  "oauth21_enabled": {
+                    "type": "boolean",
+                    "nullable": true
+                  },
                   "canonical_host": {
                     "type": "string",
                     "nullable": true
@@ -13711,6 +13744,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -16972,6 +17009,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -80400,6 +80441,14 @@
                   "response_type": {
                     "type": "string"
                   },
+                  "code_challenge": {
+                    "type": "string",
+                    "description": "PKCE challenge, without a `state` only."
+                  },
+                  "code_challenge_method": {
+                    "type": "string",
+                    "description": "Only `S256` is supported."
+                  },
                   "redirect_to": {
                     "type": "string",
                     "description": "Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored."
@@ -80475,7 +80524,7 @@
             "description": "Default Response"
           },
           "400": {
-            "description": "`invalid_code` — The verification code is wrong, expired or already used.\n\n`invalid_connection` — The connection does not exist, is disabled, or is not of the type this flow needs.\n\n`invalid_credentials` — The email/username or password is incorrect.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_code` — The verification code is wrong, expired or already used.\n\n`invalid_connection` — The connection does not exist, is disabled, or is not of the type this flow needs.\n\n`invalid_credentials` — The email/username or password is incorrect.\n\n`invalid_request` — A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n\n`oauth21_required` — The tenant enforces OAuth 2.1 (`oauth21_enabled`) and the request is one OAuth 2.1 removed: a `response_type` other than `code`, an authorization request without PKCE (`code_challenge` with `S256`), or the password grant. `message` says which. Update the application (with `@faable/auth-js`, version 3.1.0 or later) or turn `oauth21_enabled` off for the tenant.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -80492,6 +80541,8 @@
                             "invalid_code",
                             "invalid_connection",
                             "invalid_credentials",
+                            "invalid_request",
+                            "oauth21_required",
                             "validation_error"
                           ]
                         }