@faable/auth-sdk 2.9.9 → 2.9.11

package/dist/FaableAuthApi.d.ts

@@ -104,6 +104,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;

package/dist/api/generated-client.d.ts

@@ -103,6 +103,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;
@@ -189,6 +190,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;
@@ -295,6 +297,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;
@@ -384,6 +387,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;
@@ -521,6 +525,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             webauthn_rp_id?: string | null | undefined;
             logout_confirm_required?: boolean | undefined;
             dynamic_client_registration_enabled?: boolean | undefined;
+            oauth21_enabled?: boolean | undefined;
             client_id_metadata_documents_enabled?: boolean | undefined;
             canonical_host?: string | null | undefined;
             createdAt: string;
@@ -591,6 +596,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             webauthn_rp_id?: string | null | undefined;
             logout_confirm_required?: boolean | undefined;
             dynamic_client_registration_enabled?: boolean | undefined;
+            oauth21_enabled?: boolean | undefined;
             client_id_metadata_documents_enabled?: boolean | undefined;
             canonical_host?: string | null | undefined;
             createdAt: string;
@@ -664,6 +670,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             webauthn_rp_id?: string | null | undefined;
             logout_confirm_required?: boolean | undefined;
             dynamic_client_registration_enabled?: boolean | undefined;
+            oauth21_enabled?: boolean | undefined;
             client_id_metadata_documents_enabled?: boolean | undefined;
             canonical_host?: string | null | undefined;
             createdAt: string;
@@ -929,6 +936,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         webauthn_rp_id?: string | null | undefined;
         logout_confirm_required?: boolean | undefined;
         dynamic_client_registration_enabled?: boolean | undefined;
+        oauth21_enabled?: boolean | undefined;
         client_id_metadata_documents_enabled?: boolean | undefined;
         canonical_host?: string | null | undefined;
         createdAt: string;
@@ -2263,6 +2271,30 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
+    /**
+     * `POST /connect/handoff` — operationId: `connect/createHandoff`
+     *
+     * Create a one-time handoff of a client’s credentials
+     *
+     * Used by the dashboard in the «Connect with Faable» flow. Checks that `client_id` belongs to `account_id` and that its callbacks contain `<site_url>/wp-login.php?faable-auth=callback`, then stores a one-time handoff bound to the PKCE `code_challenge`, valid for 10 minutes. The response `code` is sent to the site, which redeems it with `POST /connect/exchange`. The client secret is never part of this request or response. Requires a management token for `account_id` with `update:clients`.
+     *
+     * @throws {FaableApiError} `account_mismatch` (400) — The `account_id` in the body is not the account the request is scoped to (`x-faableauth-account`).
+     * @throws {FaableApiError} `connect_redirect_uri_missing` (400) — The client's callbacks do not include `<site_url>/wp-login.php?faable-auth=callback`.
+     * @throws {FaableApiError} `invalid_site_url` (400) — `site_url` is not an absolute http(s) URL without query string or fragment.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `client_not_found` (404) — No client with that `client_id`.
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    connectCreateHandoff(data: OpBody<"connect/createHandoff">): Promise<{
+        code: string;
+        expires_at: string;
+    }>;
     /**
      * `POST /connection` — operationId: `connection/create`
      *

package/dist/api/generated-client.js

@@ -621,6 +621,29 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("client_id", client_id);
         return this.fetcher.post(`/client/${client_id}`, data);
     }
+    /**
+     * `POST /connect/handoff` — operationId: `connect/createHandoff`
+     *
+     * Create a one-time handoff of a client’s credentials
+     *
+     * Used by the dashboard in the «Connect with Faable» flow. Checks that `client_id` belongs to `account_id` and that its callbacks contain `<site_url>/wp-login.php?faable-auth=callback`, then stores a one-time handoff bound to the PKCE `code_challenge`, valid for 10 minutes. The response `code` is sent to the site, which redeems it with `POST /connect/exchange`. The client secret is never part of this request or response. Requires a management token for `account_id` with `update:clients`.
+     *
+     * @throws {FaableApiError} `account_mismatch` (400) — The `account_id` in the body is not the account the request is scoped to (`x-faableauth-account`).
+     * @throws {FaableApiError} `connect_redirect_uri_missing` (400) — The client's callbacks do not include `<site_url>/wp-login.php?faable-auth=callback`.
+     * @throws {FaableApiError} `invalid_site_url` (400) — `site_url` is not an absolute http(s) URL without query string or fragment.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `client_not_found` (404) — No client with that `client_id`.
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    connectCreateHandoff(data) {
+        return this.fetcher.post(`/connect/handoff`, data);
+    }
     /**
      * `POST /connection` — operationId: `connection/create`
      *

package/dist/api/types.d.ts

@@ -2477,6 +2477,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/connect/handoff": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create a one-time handoff of a client’s credentials
+         * @description Used by the dashboard in the «Connect with Faable» flow. Checks that `client_id` belongs to `account_id` and that its callbacks contain `<site_url>/wp-login.php?faable-auth=callback`, then stores a one-time handoff bound to the PKCE `code_challenge`, valid for 10 minutes. The response `code` is sent to the site, which redeems it with `POST /connect/exchange`. The client secret is never part of this request or response. Requires a management token for `account_id` with `update:clients`.
+         */
+        post: operations["connect/createHandoff"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connect/exchange": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Redeem a connect handoff for the client’s credentials
+         * @description Server-to-server, unauthenticated: the PKCE `code_verifier` is the proof. Returns the credentials of the client the handoff names, once — a second redemption answers 410 `handoff_used`. Errors carry `error` (same value as `error_code`). Responses are `Cache-Control: no-store`.
+         */
+        post: operations["connect/exchange"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/passwordless/verify_redirect": {
         parameters: {
             query?: never;
@@ -5808,6 +5848,8 @@ export interface components {
             logout_confirm_required?: boolean;
             /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
             dynamic_client_registration_enabled?: boolean;
+            /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+            oauth21_enabled?: boolean;
             /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
             client_id_metadata_documents_enabled?: boolean;
             /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -8534,6 +8576,7 @@ export interface components {
             logout_confirm_required?: boolean | null;
             dynamic_client_registration_enabled?: boolean | null;
             client_id_metadata_documents_enabled?: boolean | null;
+            oauth21_enabled?: boolean | null;
             canonical_host?: string | null;
             login_flow?: string | null;
         };
@@ -8759,6 +8802,7 @@ export interface components {
          *     - `not_a_member` (404): The user is not a member of the team.
          *     - `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.
          *     - `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.
+         *     - `oauth21_required` (400): The tenant enforces OAuth 2.1 (`oauth21_enabled`) and the request is one OAuth 2.1 removed: a `response_type` other than `code`, an authorization request without PKCE (`code_challenge` with `S256`), or the password grant. `message` says which. Update the application (with `@faable/auth-js`, version 3.1.0 or later) or turn `oauth21_enabled` off for the tenant.
          *     - `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.
          *     - `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.
          *     - `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.
@@ -8785,9 +8829,16 @@ export interface components {
          *     - `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.
          *     - `delivery_not_found` (404): No webhook delivery with that id for this subscription.
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
+         *     - `account_mismatch` (400): The `account_id` in the body is not the account the request is scoped to (`x-faableauth-account`).
+         *     - `connect_redirect_uri_missing` (400): The client's callbacks do not include `<site_url>/wp-login.php?faable-auth=callback`.
+         *     - `invalid_site_url` (400): `site_url` is not an absolute http(s) URL without query string or fragment.
+         *     - `handoff_not_found` (404): No connect handoff matches that code.
+         *     - `handoff_expired` (410): The connect handoff is past its expiry. Start again.
+         *     - `handoff_used` (410): The connect handoff was already redeemed.
+         *     - `invalid_code_verifier` (400): `code_verifier` does not match the `code_challenge` of the handoff.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "last_sign_in_method" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "invalid_saml_request" | "saml_sp_mismatch" | "saml_not_enabled" | "invalid_saml_sp" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "reauth_required" | "invalid_current_password" | "email_not_verified" | "invalid_profile_field" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "invalid_permission" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "last_sign_in_method" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "invalid_saml_request" | "saml_sp_mismatch" | "saml_not_enabled" | "invalid_saml_sp" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "reauth_required" | "invalid_current_password" | "email_not_verified" | "invalid_profile_field" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "oauth21_required" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "invalid_permission" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress" | "account_mismatch" | "connect_redirect_uri_missing" | "invalid_site_url" | "handoff_not_found" | "handoff_expired" | "handoff_used" | "invalid_code_verifier";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -8960,6 +9011,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -9330,6 +9383,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -9588,6 +9643,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -9795,6 +9852,7 @@ export interface operations {
                     logout_confirm_required?: boolean | null;
                     dynamic_client_registration_enabled?: boolean | null;
                     client_id_metadata_documents_enabled?: boolean | null;
+                    oauth21_enabled?: boolean | null;
                     canonical_host?: string | null;
                     login_flow?: string | null;
                 };
@@ -9934,6 +9992,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -11315,6 +11375,8 @@ export interface operations {
                         logout_confirm_required?: boolean;
                         /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
                         dynamic_client_registration_enabled?: boolean;
+                        /** @description When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later. */
+                        oauth21_enabled?: boolean;
                         /** @description When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default. */
                         client_id_metadata_documents_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
@@ -33494,6 +33556,245 @@ export interface operations {
             };
         };
     };
+    "connect/createHandoff": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The tenant that owns the client. */
+                    account_id: string;
+                    /** @description The OAuth `client_id` of the client created for the site (the resource `id`, `client_…`, is accepted too). */
+                    client_id: string;
+                    /** @description The site's PKCE challenge: BASE64URL(SHA256(code_verifier)), unpadded. */
+                    code_challenge: string;
+                    /** @enum {string} */
+                    code_challenge_method: "S256";
+                    /** @description The site's base URL. The client's callbacks must contain `<site_url>/wp-login.php?faable-auth=callback`. */
+                    site_url: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description One-time code for `POST /connect/exchange`. Shown once; only its hash is stored. */
+                        code: string;
+                        /** Format: date-time */
+                        expires_at: string;
+                    };
+                };
+            };
+            /**
+             * @description `account_mismatch` — The `account_id` in the body is not the account the request is scoped to (`x-faableauth-account`).
+             *
+             *     `connect_redirect_uri_missing` — The client's callbacks do not include `<site_url>/wp-login.php?faable-auth=callback`.
+             *
+             *     `invalid_site_url` — `site_url` is not an absolute http(s) URL without query string or fragment.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_mismatch" | "connect_redirect_uri_missing" | "invalid_site_url" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `account_not_found` — No Auth Account matches the request (domain, header or token).
+             *
+             *     `client_not_found` — No client with that `client_id`.
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found" | "client_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "connect/exchange": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    code: string;
+                    /** @description The PKCE verifier behind the handoff `code_challenge`. */
+                    code_verifier: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Base URL of the tenant: `<auth_domain>/.well-known/openid-configuration` is its discovery document. */
+                        auth_domain: string;
+                        client_id: string;
+                        client_secret: string;
+                        project_id: string | null;
+                        account_id: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_code_verifier` — `code_verifier` does not match the `code_challenge` of the handoff.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_code_verifier" | "validation_error";
+                    };
+                };
+            };
+            /**
+             * @description `handoff_not_found` — No connect handoff matches that code.
+             *
+             *     `client_not_found` — No client with that `client_id`.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "handoff_not_found" | "client_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /**
+             * @description `handoff_expired` — The connect handoff is past its expiry. Start again.
+             *
+             *     `handoff_used` — The connect handoff was already redeemed.
+             */
+            410: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "handoff_expired" | "handoff_used";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "passwordless/verify_redirect": {
         parameters: {
             query: {
@@ -37373,6 +37674,8 @@ export interface operations {
              *
              *     `invalid_request` — A required OAuth parameter is missing or two of them are incompatible. `message` says which.
              *
+             *     `oauth21_required` — The tenant enforces OAuth 2.1 (`oauth21_enabled`) and the request is one OAuth 2.1 removed: a `response_type` other than `code`, an authorization request without PKCE (`code_challenge` with `S256`), or the password grant. `message` says which. Update the application (with `@faable/auth-js`, version 3.1.0 or later) or turn `oauth21_enabled` off for the tenant.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -37382,7 +37685,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_code" | "invalid_connection" | "invalid_credentials" | "invalid_request" | "validation_error";
+                        error_code?: "invalid_code" | "invalid_connection" | "invalid_credentials" | "invalid_request" | "oauth21_required" | "validation_error";
                     };
                 };
             };

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.9.9";
+export const version = "2.9.11";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "dba1c7a";
+export const commit = "57570b7";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.9.9",
+  "version": "2.9.11",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.97.0",
+    "version": "2.99.1",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -591,6 +591,10 @@
             "type": "boolean",
             "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
           },
+          "oauth21_enabled": {
+            "type": "boolean",
+            "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+          },
           "client_id_metadata_documents_enabled": {
             "type": "boolean",
             "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -9374,6 +9378,10 @@
             "type": "boolean",
             "nullable": true
           },
+          "oauth21_enabled": {
+            "type": "boolean",
+            "nullable": true
+          },
           "canonical_host": {
             "type": "string",
             "nullable": true
@@ -9717,7 +9725,7 @@
       },
       "ErrorCode": {
         "type": "string",
-        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `last_sign_in_method` (409): Unlinking this account would leave the user with no way to sign in: set a password, verify the email or link another account first.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (403): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): A client field was rejected: by dynamic client registration (RFC 7591), or on a client create/update (`initiate_login_uri`). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `invalid_saml_request` (400): The SAMLRequest is missing, too large, not well-formed or not a SAML 2.0 AuthnRequest.\n- `saml_sp_mismatch` (400): The AuthnRequest does not match the client's SAML configuration: its Issuer is not the configured entity_id, or it asks for another Assertion Consumer Service URL or binding.\n- `saml_not_enabled` (404): This client does not have SAML enabled.\n- `invalid_saml_sp` (400): The `saml_sp` configuration is invalid: `acs_url` must be an absolute https URL without a fragment.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `reauth_required` (403): The operation needs a recent sign-in (and the second factor, when the user has one). Sign in again with `max_age=0` and retry with the new token.\n- `invalid_current_password` (400): The current password is wrong.\n- `email_not_verified` (403): The user's email is not verified, and the operation needs it to be.\n- `invalid_profile_field` (400): A profile field is not declared for this application, or its value does not match the declaration. `message` names the key.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.\n- `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.\n- `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.\n- `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.\n- `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.\n- `organization_domain_not_found` (404): The organization has no such domain.\n- `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.\n- `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.\n- `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.\n- `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.\n- `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.\n- `organization_has_no_idp` (400): Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.\n- `organization_not_found` (404): No organization with that id in this account.\n- `invalid_user` (400): The user does not exist in this account.\n- `not_an_organization_admin` (404): The user is not an admin of the organization.\n- `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `invalid_permission` (400): A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.",
+        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `last_sign_in_method` (409): Unlinking this account would leave the user with no way to sign in: set a password, verify the email or link another account first.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (403): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): A client field was rejected: by dynamic client registration (RFC 7591), or on a client create/update (`initiate_login_uri`). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `invalid_saml_request` (400): The SAMLRequest is missing, too large, not well-formed or not a SAML 2.0 AuthnRequest.\n- `saml_sp_mismatch` (400): The AuthnRequest does not match the client's SAML configuration: its Issuer is not the configured entity_id, or it asks for another Assertion Consumer Service URL or binding.\n- `saml_not_enabled` (404): This client does not have SAML enabled.\n- `invalid_saml_sp` (400): The `saml_sp` configuration is invalid: `acs_url` must be an absolute https URL without a fragment.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `reauth_required` (403): The operation needs a recent sign-in (and the second factor, when the user has one). Sign in again with `max_age=0` and retry with the new token.\n- `invalid_current_password` (400): The current password is wrong.\n- `email_not_verified` (403): The user's email is not verified, and the operation needs it to be.\n- `invalid_profile_field` (400): A profile field is not declared for this application, or its value does not match the declaration. `message` names the key.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.\n- `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.\n- `oauth21_required` (400): The tenant enforces OAuth 2.1 (`oauth21_enabled`) and the request is one OAuth 2.1 removed: a `response_type` other than `code`, an authorization request without PKCE (`code_challenge` with `S256`), or the password grant. `message` says which. Update the application (with `@faable/auth-js`, version 3.1.0 or later) or turn `oauth21_enabled` off for the tenant.\n- `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.\n- `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.\n- `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.\n- `organization_domain_not_found` (404): The organization has no such domain.\n- `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.\n- `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.\n- `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.\n- `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.\n- `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.\n- `organization_has_no_idp` (400): Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.\n- `organization_not_found` (404): No organization with that id in this account.\n- `invalid_user` (400): The user does not exist in this account.\n- `not_an_organization_admin` (404): The user is not an admin of the organization.\n- `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `invalid_permission` (400): A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.\n- `account_mismatch` (400): The `account_id` in the body is not the account the request is scoped to (`x-faableauth-account`).\n- `connect_redirect_uri_missing` (400): The client's callbacks do not include `<site_url>/wp-login.php?faable-auth=callback`.\n- `invalid_site_url` (400): `site_url` is not an absolute http(s) URL without query string or fragment.\n- `handoff_not_found` (404): No connect handoff matches that code.\n- `handoff_expired` (410): The connect handoff is past its expiry. Start again.\n- `handoff_used` (410): The connect handoff was already redeemed.\n- `invalid_code_verifier` (400): `code_verifier` does not match the `code_challenge` of the handoff.",
         "enum": [
           "bad_request",
           "validation_error",
@@ -9848,6 +9856,7 @@
           "not_a_member",
           "consent_options_unavailable",
           "consent_choice_invalid",
+          "oauth21_required",
           "registration_disabled",
           "invalid_email_domain",
           "public_email_domain",
@@ -9873,7 +9882,14 @@
           "invalid_webhook_url",
           "not_a_webhook",
           "delivery_not_found",
-          "delivery_in_progress"
+          "delivery_in_progress",
+          "account_mismatch",
+          "connect_redirect_uri_missing",
+          "invalid_site_url",
+          "handoff_not_found",
+          "handoff_expired",
+          "handoff_used",
+          "invalid_code_verifier"
         ]
       },
       "ErrorResponse": {
@@ -10585,6 +10601,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -11392,6 +11412,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -12436,6 +12460,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -13128,6 +13156,10 @@
                     "type": "boolean",
                     "nullable": true
                   },
+                  "oauth21_enabled": {
+                    "type": "boolean",
+                    "nullable": true
+                  },
                   "canonical_host": {
                     "type": "string",
                     "nullable": true
@@ -13719,6 +13751,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -16980,6 +17016,10 @@
                       "type": "boolean",
                       "description": "When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`."
                     },
+                    "oauth21_enabled": {
+                      "type": "boolean",
+                      "description": "When true, the tenant enforces OAuth 2.1: `/authorize` accepts only `response_type=code` and requires PKCE (`code_challenge` with `S256`) from every client, a password login without `/authorize` needs PKCE too, and the password grant is refused. Refused requests answer `oauth21_required`. On for new tenants; an existing tenant turns it on when its applications are ready — with `@faable/auth-js` that is version 3.1.0 or later."
+                    },
                     "client_id_metadata_documents_enabled": {
                       "type": "boolean",
                       "description": "When true, /authorize accepts a `client_id` that is an https URL serving a Client ID Metadata Document (the MCP authorization way to identify a client without registering it). Such clients always see the consent screen. Off by default."
@@ -68450,6 +68490,462 @@
         }
       }
     },
+    "/connect/handoff": {
+      "post": {
+        "operationId": "connect/createHandoff",
+        "summary": "Create a one-time handoff of a client’s credentials",
+        "tags": [
+          "connect"
+        ],
+        "description": "Used by the dashboard in the «Connect with Faable» flow. Checks that `client_id` belongs to `account_id` and that its callbacks contain `<site_url>/wp-login.php?faable-auth=callback`, then stores a one-time handoff bound to the PKCE `code_challenge`, valid for 10 minutes. The response `code` is sent to the site, which redeems it with `POST /connect/exchange`. The client secret is never part of this request or response. Requires a management token for `account_id` with `update:clients`.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "account_id",
+                  "client_id",
+                  "code_challenge",
+                  "code_challenge_method",
+                  "site_url"
+                ],
+                "properties": {
+                  "account_id": {
+                    "type": "string",
+                    "pattern": "^account_[0-9a-f]{24}$",
+                    "description": "The tenant that owns the client."
+                  },
+                  "client_id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200,
+                    "description": "The OAuth `client_id` of the client created for the site (the resource `id`, `client_…`, is accepted too)."
+                  },
+                  "code_challenge": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9_-]{43}$",
+                    "description": "The site's PKCE challenge: BASE64URL(SHA256(code_verifier)), unpadded."
+                  },
+                  "code_challenge_method": {
+                    "type": "string",
+                    "enum": [
+                      "S256"
+                    ]
+                  },
+                  "site_url": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 2048,
+                    "description": "The site's base URL. The client's callbacks must contain `<site_url>/wp-login.php?faable-auth=callback`."
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "code",
+                    "expires_at"
+                  ],
+                  "properties": {
+                    "code": {
+                      "type": "string",
+                      "description": "One-time code for `POST /connect/exchange`. Shown once; only its hash is stored."
+                    },
+                    "expires_at": {
+                      "type": "string",
+                      "format": "date-time"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`account_mismatch` — The `account_id` in the body is not the account the request is scoped to (`x-faableauth-account`).\n\n`connect_redirect_uri_missing` — The client's callbacks do not include `<site_url>/wp-login.php?faable-auth=callback`.\n\n`invalid_site_url` — `site_url` is not an absolute http(s) URL without query string or fragment.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_mismatch",
+                            "connect_redirect_uri_missing",
+                            "invalid_site_url",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).\n\n`client_not_found` — No client with that `client_id`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found",
+                            "client_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/connect/exchange": {
+      "post": {
+        "operationId": "connect/exchange",
+        "summary": "Redeem a connect handoff for the client’s credentials",
+        "tags": [
+          "connect"
+        ],
+        "description": "Server-to-server, unauthenticated: the PKCE `code_verifier` is the proof. Returns the credentials of the client the handoff names, once — a second redemption answers 410 `handoff_used`. Errors carry `error` (same value as `error_code`). Responses are `Cache-Control: no-store`.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "code",
+                  "code_verifier"
+                ],
+                "properties": {
+                  "code": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  "code_verifier": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9._~-]{43,128}$",
+                    "description": "The PKCE verifier behind the handoff `code_challenge`."
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "auth_domain",
+                    "client_id",
+                    "client_secret",
+                    "project_id",
+                    "account_id"
+                  ],
+                  "properties": {
+                    "auth_domain": {
+                      "type": "string",
+                      "description": "Base URL of the tenant: `<auth_domain>/.well-known/openid-configuration` is its discovery document."
+                    },
+                    "client_id": {
+                      "type": "string"
+                    },
+                    "client_secret": {
+                      "type": "string"
+                    },
+                    "project_id": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "account_id": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_code_verifier` — `code_verifier` does not match the `code_challenge` of the handoff.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_code_verifier",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`handoff_not_found` — No connect handoff matches that code.\n\n`client_not_found` — No client with that `client_id`.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "handoff_not_found",
+                            "client_not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "410": {
+            "description": "`handoff_expired` — The connect handoff is past its expiry. Start again.\n\n`handoff_used` — The connect handoff was already redeemed.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "handoff_expired",
+                            "handoff_used"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/passwordless/verify_redirect": {
       "get": {
         "operationId": "passwordless/verify_redirect",
@@ -80491,7 +80987,7 @@
             "description": "Default Response"
           },
           "400": {
-            "description": "`invalid_code` — The verification code is wrong, expired or already used.\n\n`invalid_connection` — The connection does not exist, is disabled, or is not of the type this flow needs.\n\n`invalid_credentials` — The email/username or password is incorrect.\n\n`invalid_request` — A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_code` — The verification code is wrong, expired or already used.\n\n`invalid_connection` — The connection does not exist, is disabled, or is not of the type this flow needs.\n\n`invalid_credentials` — The email/username or password is incorrect.\n\n`invalid_request` — A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n\n`oauth21_required` — The tenant enforces OAuth 2.1 (`oauth21_enabled`) and the request is one OAuth 2.1 removed: a `response_type` other than `code`, an authorization request without PKCE (`code_challenge` with `S256`), or the password grant. `message` says which. Update the application (with `@faable/auth-js`, version 3.1.0 or later) or turn `oauth21_enabled` off for the tenant.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -80509,6 +81005,7 @@
                             "invalid_connection",
                             "invalid_credentials",
                             "invalid_request",
+                            "oauth21_required",
                             "validation_error"
                           ]
                         }
@@ -81870,6 +82367,10 @@
         "url": "https://faable.com/docs/auth/clients"
       }
     },
+    {
+      "name": "connect",
+      "description": "«Connect with Faable»: a one-time, PKCE-bound handoff of an OAuth client’s credentials to a third-party site (the WordPress plugin), so nobody copies a secret by hand."
+    },
     {
       "name": "oauth",
       "description": "OAuth Endpoints",