oauthlib 3.3.0__tar.gz → 4.0.0__tar.gz

{oauthlib-3.3.0 → oauthlib-4.0.0}/CHANGELOG.rst

@@ -1,6 +1,40 @@
 Changelog
 =========
 
+4.0.0 (2026-09-28):
+------------------
+OAuth2.0 Provider:
+* **Breaking**: #951: Removed JSONP support from token revocation endpoint.
+  JSONP has been superseded by CORS for cross-origin requests.
+  The ``enable_jsonp`` parameter has been removed from ``RevocationEndpoint``
+  and the ``callback`` parameter has been removed from
+  ``prepare_token_revocation_request``.
+* **Breaking**: #919, #920: Fixed ``DeviceCodeGrant.validate_token_request``
+  trying to authenticate public clients.
+  Client authentication validation has been reorganized and is now shared
+  across ``AuthorizationCodeGrant``, ``DeviceCodeGrant``, ``RefreshTokenGrant``
+  and ``ResourceOwnerPasswordCredentialsGrant``: the ``grant_type`` parameter
+  is validated before client authentication, so requests missing
+  ``grant_type`` now return ``400 invalid_request`` instead of
+  ``401 invalid_client``.
+* #963: Improved PKCE code comparison
+
+Misc:
+* #904: Stop installing ``examples`` into ``site-packages``.
+* #930: Add devcontainer, Add Python3.14, Python3.14t.
+* #931: Fix ruff checks about unused variables.
+* #932: Dropped EOL Python 3.8 from CI.
+* #934: Pre-commit hooks autoupdate.
+* #938: Fix typos discovered by typos.
+* Add OAuthLib Maintainer agent for automated issue/PR triage and release
+  management.
+
+3.3.1 (2025-06-19):
+------------------
+OAuth2.0 Client:
+* #906: fix regression of expires_in parsing when float in string.
+
+
 3.3.0 (2025-06-17):
 ------------------
 OAuth2.0 Provider:
@@ -95,7 +129,7 @@ General
   * #727: build isort integration
   * #734: python2 code removal
   * #735, #750: add python3.8 support
-  * #749: bump minimum versions of pyjwt and cryptography 
+  * #749: bump minimum versions of pyjwt and cryptography
 
 3.1.0 (2019-08-06)
 ------------------
@@ -407,7 +441,7 @@ Draft revocation endpoint features and numerous fixes including:
 
 * (OAuth 2 Provider) returned JSON headers no longer include charset.
 
-* (OAuth 2 Provider) validate_authorizatoin_request now also includes the
+* (OAuth 2 Provider) validate_authorization_request now also includes the
   internal request object in the returned dictionary. Note that this is
   not meant to be relied upon heavily and its interface might change.
 

{oauthlib-3.3.0/oauthlib.egg-info → oauthlib-4.0.0}/PKG-INFO

@@ -1,12 +1,18 @@
 Metadata-Version: 2.4
 Name: oauthlib
-Version: 3.3.0
+Version: 4.0.0
 Summary: A generic, spec-compliant, thorough implementation of the OAuth request-signing logic
 Home-page: https://github.com/oauthlib/oauthlib
 Author: The OAuthlib Community
 Maintainer: Jonathan Huot
 Maintainer-email: jonathan.huot@gmail.com
 License: BSD-3-Clause
+Project-URL: Changelog, https://github.com/oauthlib/oauthlib/blob/master/CHANGELOG.rst
+Project-URL: Documentation, https://oauthlib.readthedocs.io/
+Project-URL: Gitter, https://gitter.im/oauthlib/Lobby
+Project-URL: Issues, https://github.com/oauthlib/oauthlib/issues
+Project-URL: Source, https://github.com/oauthlib/oauthlib
+Project-URL: Sponsor, https://github.com/sponsors/JonathanHuot
 Platform: any
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Web Environment
@@ -16,18 +22,18 @@ Classifier: Operating System :: POSIX
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: Python :: Implementation
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.8
+Requires-Python: >=3.9
 Description-Content-Type: text/x-rst
 License-File: LICENSE
 Provides-Extra: rsa
@@ -47,6 +53,7 @@ Dynamic: license-file
 Dynamic: maintainer
 Dynamic: maintainer-email
 Dynamic: platform
+Dynamic: project-url
 Dynamic: provides-extra
 Dynamic: requires-python
 Dynamic: summary
@@ -57,6 +64,9 @@ OAuthLib - Python Framework for OAuth1 & OAuth2
 *A generic, spec-compliant, thorough implementation of the OAuth request-signing
 logic for Python 3.8+*
 
+.. image:: https://img.shields.io/static/v1?label=Dev%20Containers&message=Open&color=blue
+  :target: https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/oauthlib/oauthlib
+  :alt: Open DevContainer in VSCode
 .. image:: https://github.com/oauthlib/oauthlib/actions/workflows/python-build.yml/badge.svg
   :target: https://github.com/oauthlib/oauthlib/actions
   :alt: GitHub Actions

{oauthlib-3.3.0 → oauthlib-4.0.0}/README.rst

@@ -4,6 +4,9 @@ OAuthLib - Python Framework for OAuth1 & OAuth2
 *A generic, spec-compliant, thorough implementation of the OAuth request-signing
 logic for Python 3.8+*
 
+.. image:: https://img.shields.io/static/v1?label=Dev%20Containers&message=Open&color=blue
+  :target: https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/oauthlib/oauthlib
+  :alt: Open DevContainer in VSCode
 .. image:: https://github.com/oauthlib/oauthlib/actions/workflows/python-build.yml/badge.svg
   :target: https://github.com/oauthlib/oauthlib/actions
   :alt: GitHub Actions

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/__init__.py

@@ -12,7 +12,7 @@ import logging
 from logging import NullHandler
 
 __author__ = 'The OAuthlib Community'
-__version__ = '3.3.0'
+__version__ = '4.0.0'
 
 logging.getLogger('oauthlib').addHandler(NullHandler())
 

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/common.py

@@ -371,6 +371,7 @@ class Request:
             "redirect_uri": None,
             "refresh_token": None,
             "request_token": None,
+            "resource": None,
             "response_type": None,
             "scope": None,
             "scopes": None,

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth1/rfc5849/endpoints/access_token.py

@@ -102,7 +102,7 @@ class AccessTokenEndpoint(BaseEndpoint):
         resp_headers = {'Content-Type': 'application/x-www-form-urlencoded'}
         try:
             request = self._create_request(uri, http_method, body, headers)
-            valid, processed_request = self.validate_access_token_request(
+            valid, _processed_request = self.validate_access_token_request(
                 request)
             if valid:
                 token = self.create_access_token(request, credentials or {})
@@ -183,7 +183,7 @@ class AccessTokenEndpoint(BaseEndpoint):
         # .. _`Section 3.2`: https://tools.ietf.org/html/rfc5849#section-3.2
         #
         # Note that early exit would enable resource owner authorization
-        # verifier enumertion.
+        # verifier enumeration.
         valid_verifier = self.request_validator.validate_verifier(
             request.client_key,
             request.resource_owner_key,

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth1/rfc5849/endpoints/base.py

@@ -73,7 +73,7 @@ class BaseEndpoint:
             request = Request(uri, http_method, body, headers)
         else:
             request = Request(uri, http_method, '', headers)
-        signature_type, params, oauth_params = (
+        _signature_type, params, oauth_params = (
             self._get_signature_type_and_params(request))
 
         # The server SHOULD return a 400 (Bad Request) status code when

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth1/rfc5849/endpoints/request_token.py

@@ -97,7 +97,7 @@ class RequestTokenEndpoint(BaseEndpoint):
         resp_headers = {'Content-Type': 'application/x-www-form-urlencoded'}
         try:
             request = self._create_request(uri, http_method, body, headers)
-            valid, processed_request = self.validate_request_token_request(
+            valid, _processed_request = self.validate_request_token_request(
                 request)
             if valid:
                 token = self.create_request_token(request, credentials or {})

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth1/rfc5849/errors.py

@@ -2,7 +2,7 @@
 oauthlib.oauth1.rfc5849.errors
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Error used both by OAuth 1 clients and provicers to represent the spec
+Error used both by OAuth 1 clients and providers to represent the spec
 defined error responses for all four core grant types.
 """
 from oauthlib.common import add_params_to_uri, urlencode

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/__init__.py

@@ -66,5 +66,6 @@ from .rfc6749.request_validator import RequestValidator
 from .rfc6749.tokens import BearerToken, OAuth2Token
 from .rfc6749.utils import is_secure_transport
 from .rfc8628.clients import DeviceClient
-from oauthlib.oauth2.rfc8628.endpoints import DeviceAuthorizationEndpoint, DeviceApplicationServer
-from oauthlib.oauth2.rfc8628.grant_types import DeviceCodeGrant
+from .rfc8628.endpoints import DeviceApplicationServer, DeviceAuthorizationEndpoint
+from .rfc8628.errors import AccessDenied, AuthorizationPendingError, ExpiredTokenError, SlowDownError
+from .rfc8628.grant_types import DeviceCodeGrant

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/rfc6749/clients/base.py

@@ -320,7 +320,7 @@ class Client:
         return token_url, FORM_ENC_HEADERS, body
 
     def prepare_token_revocation_request(self, revocation_url, token,
-                                         token_type_hint="access_token", body='', callback=None, **kwargs):
+                                         token_type_hint="access_token", body='', **kwargs):
         """Prepare a token revocation request.
 
         :param revocation_url: Provider token revocation endpoint URL.
@@ -329,14 +329,9 @@ class Client:
             ``"refresh_token"``. This is optional and if you wish to not pass it you
             must provide ``token_type_hint=None``.
         :param body:
-        :param callback: A jsonp callback such as ``package.callback`` to be invoked
-            upon receiving the response. Not that it should not include a () suffix.
         :param kwargs: Additional parameters to included in the request.
         :returns: The prepared request tuple with (url, headers, body).
 
-        Note that JSONP request may use GET requests as the parameters will
-        be added to the request URL query as opposed to the request body.
-
         An example of a revocation request
 
         .. code-block:: http
@@ -348,21 +343,6 @@ class Client:
 
             token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token
 
-        An example of a jsonp revocation request
-
-        .. code-block:: http
-
-            GET /revoke?token=agabcdefddddafdd&callback=package.myCallback HTTP/1.1
-            Host: server.example.com
-            Content-Type: application/x-www-form-urlencoded
-            Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
-
-        and an error response
-
-        .. code-block:: javascript
-
-            package.myCallback({"error":"unsupported_token_type"});
-
         Note that these requests usually require client credentials, client_id in
         the case for public clients and provider specific authentication
         credentials for confidential clients.
@@ -370,8 +350,11 @@ class Client:
         if not is_secure_transport(revocation_url):
             raise InsecureTransportError()
 
+        if 'callback' in kwargs:
+            raise TypeError("prepare_token_revocation_request() got an unexpected keyword argument 'callback'")
+
         return prepare_token_revocation_request(revocation_url, token,
-                                                token_type_hint=token_type_hint, body=body, callback=callback,
+                                                token_type_hint=token_type_hint, body=body,
                                                 **kwargs)
 
     def parse_request_body_response(self, body, scope=None, **kwargs):

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/rfc6749/clients/service_application.py

@@ -17,7 +17,7 @@ from .base import Client
 class ServiceApplicationClient(Client):
     """A public client utilizing the JWT bearer grant.
 
-    JWT bearer tokes can be used to request an access token when a client
+    JWT bearer tokens can be used to request an access token when a client
     wishes to utilize an existing trust relationship, expressed through the
     semantics of (and digital signature or keyed message digest calculated
     over) the JWT, without a direct user approval step at the authorization

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/rfc6749/endpoints/revocation.py

@@ -27,13 +27,11 @@ class RevocationEndpoint(BaseEndpoint):
     valid_token_types = ('access_token', 'refresh_token')
     valid_request_methods = ('POST',)
 
-    def __init__(self, request_validator, supported_token_types=None,
-            enable_jsonp=False):
+    def __init__(self, request_validator, supported_token_types=None):
         BaseEndpoint.__init__(self)
         self.request_validator = request_validator
         self.supported_token_types = (
             supported_token_types or self.valid_token_types)
-        self.enable_jsonp = enable_jsonp
 
     @catch_errors_and_unavailability
     def create_revocation_response(self, uri, http_method='POST', body=None,
@@ -69,18 +67,13 @@ class RevocationEndpoint(BaseEndpoint):
         except OAuth2Error as e:
             log.debug('Client error during validation of %r. %r.', request, e)
             response_body = e.json
-            if self.enable_jsonp and request.callback:
-                response_body = '{}({});'.format(request.callback, response_body)
             resp_headers.update(e.headers)
             return resp_headers, response_body, e.status_code
 
         self.request_validator.revoke_token(request.token,
                                             request.token_type_hint, request)
 
-        response_body = ''
-        if self.enable_jsonp and request.callback:
-            response_body = request.callback + '();'
-        return {}, response_body, 200
+        return {}, '', 200
 
     def validate_revocation_request(self, request):
         """Ensure the request is valid.

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py

@@ -4,6 +4,7 @@ oauthlib.oauth2.rfc6749.grant_types
 """
 import base64
 import hashlib
+import hmac
 import json
 import logging
 
@@ -39,14 +40,15 @@ def code_challenge_method_s256(verifier, challenge):
         return s;
     }
 
-    In python urlsafe_b64encode is already replacing '+' and '/', but preserve
-    the trailing '='. So we have to remove it.
+    Python's urlsafe_b64encode() replaces '+' and '/', but preserves the
+    trailing '=', so we have to remove it.
 
     .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3
     """
-    return base64.urlsafe_b64encode(
+    expected = base64.urlsafe_b64encode(
         hashlib.sha256(verifier.encode()).digest()
-    ).decode().rstrip('=') == challenge
+    ).decode().rstrip('=')
+    return hmac.compare_digest(expected, challenge)
 
 
 def code_challenge_method_plain(verifier, challenge):
@@ -58,7 +60,7 @@ def code_challenge_method_plain(verifier, challenge):
 
     .. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3
     """
-    return verifier == challenge
+    return hmac.compare_digest(verifier, challenge)
 
 
 class AuthorizationCodeGrant(GrantTypeBase):
@@ -452,28 +454,7 @@ class AuthorizationCodeGrant(GrantTypeBase):
                 raise errors.InvalidRequestError(description='Duplicate %s parameter.' % param,
                                                  request=request)
 
-        if self.request_validator.client_authentication_required(request):
-            # If the client type is confidential or the client was issued client
-            # credentials (or assigned other authentication requirements), the
-            # client MUST authenticate with the authorization server as described
-            # in Section 3.2.1.
-            # https://tools.ietf.org/html/rfc6749#section-3.2.1
-            if not self.request_validator.authenticate_client(request):
-                log.debug('Client authentication failed, %r.', request)
-                raise errors.InvalidClientError(request=request)
-        elif not self.request_validator.authenticate_client_id(request.client_id, request):
-            # REQUIRED, if the client is not authenticating with the
-            # authorization server as described in Section 3.2.1.
-            # https://tools.ietf.org/html/rfc6749#section-3.2.1
-            log.debug('Client authentication failed, %r.', request)
-            raise errors.InvalidClientError(request=request)
-
-        if not hasattr(request.client, 'client_id'):
-            raise NotImplementedError('Authenticate client must set the '
-                                      'request.client.client_id attribute '
-                                      'in authenticate_client.')
-
-        request.client_id = request.client_id or request.client.client_id
+        self.validate_client_authentication(request)
 
         # Ensure client is authorized use of this grant type
         self.validate_grant_type(request)

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/rfc6749/grant_types/base.py

@@ -175,6 +175,57 @@ class GrantTypeBase:
                                                       request.scopes, request.client, request):
             raise errors.InvalidScopeError(request=request)
 
+    def validate_client_confidential(self, request):
+        # If the client type is confidential or the client was issued client
+        # credentials (or assigned other authentication requirements), the
+        # client MUST authenticate with the authorization server as described
+        # in Section 3.2.1.
+        # https://tools.ietf.org/html/rfc6749#section-3.2.1
+        log.debug('Authenticating confidential client, %r.', request)
+        if not self.request_validator.authenticate_client(request):
+            log.debug('Client authentication failed, %r.', request)
+            raise errors.InvalidClientError(request=request)
+
+        if request.client is None or \
+            not hasattr(request.client, 'client_id'):
+            raise NotImplementedError('Authenticate client must set the '
+                                      'request.client.client_id attribute '
+                                      'in authenticate_client.')
+
+        if not request.client_id:
+            request.client_id = request.client.client_id
+        elif request.client_id != request.client.client_id:
+            raise errors.ServerError('Discrepency found between client identifier')
+
+    def validate_client_public(self, request):
+        # REQUIRED, if the client is not authenticating with the
+        # authorization server as described in Section 3.2.1.
+        # https://tools.ietf.org/html/rfc6749#section-3.2.1
+        log.debug('Authenticating public client, %r.', request)
+        if not self.request_validator.authenticate_client_id(request.client_id, request):
+            log.debug('Client authentication failed, %r.', request)
+            raise errors.InvalidClientError(request=request)
+
+        if request.client is None or \
+            not hasattr(request.client, 'client_id'):
+            raise NotImplementedError('Authenticate client must set the '
+                                      'request.client.client_id attribute '
+                                      'in authenticate_client.')
+
+        if not request.client_id:
+            request.client_id = request.client.client_id
+        elif request.client_id != request.client.client_id:
+            raise errors.ServerError('Discrepency found between client identifier')
+
+    def validate_client_authentication(self, request):
+        """Raise on failed client authentication."""
+        # Handles confidential clients
+        if self.request_validator.client_authentication_required(request):
+            self.validate_client_confidential(request)
+        # Handles public clients
+        else:
+            self.validate_client_public(request)
+
     def prepare_authorization_response(self, request, token, headers, body, status):
         """Place token according to response mode.
 

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py

@@ -103,18 +103,11 @@ class ClientCredentialsGrant(GrantTypeBase):
                 raise errors.InvalidRequestError(description='Duplicate %s parameter.' % param,
                                                  request=request)
 
-        log.debug('Authenticating client, %r.', request)
-        if not self.request_validator.authenticate_client(request):
-            log.debug('Client authentication failed, %r.', request)
-            raise errors.InvalidClientError(request=request)
-        elif not hasattr(request.client, 'client_id'):
-            raise NotImplementedError('Authenticate client must set the '
-                                      'request.client.client_id attribute '
-                                      'in authenticate_client.')
+        self.validate_client_confidential(request)
+
         # Ensure client is authorized use of this grant type
         self.validate_grant_type(request)
 
-        request.client_id = request.client_id or request.client.client_id
         log.debug('Authorizing access to client %r.', request.client_id)
         self.validate_scopes(request)
 

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/rfc6749/grant_types/refresh_token.py

@@ -91,22 +91,8 @@ class RefreshTokenGrant(GrantTypeBase):
 
         # Because refresh tokens are typically long-lasting credentials used to
         # request additional access tokens, the refresh token is bound to the
-        # client to which it was issued.  If the client type is confidential or
-        # the client was issued client credentials (or assigned other
-        # authentication requirements), the client MUST authenticate with the
-        # authorization server as described in Section 3.2.1.
-        # https://tools.ietf.org/html/rfc6749#section-3.2.1
-        if self.request_validator.client_authentication_required(request):
-            log.debug('Authenticating client, %r.', request)
-            if not self.request_validator.authenticate_client(request):
-                log.debug('Invalid client (%r), denying access.', request)
-                raise errors.InvalidClientError(request=request)
-            # Ensure that request.client_id is set.
-            if request.client_id is None and request.client is not None:
-                request.client_id = request.client.client_id
-        elif not self.request_validator.authenticate_client_id(request.client_id, request):
-            log.debug('Client authentication failed, %r.', request)
-            raise errors.InvalidClientError(request=request)
+        # client to which it was issued
+        self.validate_client_authentication(request)
 
         # Ensure client is authorized use of this grant type
         self.validate_grant_type(request)

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py

@@ -85,14 +85,6 @@ class ResourceOwnerPasswordCredentialsGrant(GrantTypeBase):
         """
         headers = self._get_default_headers()
         try:
-            if self.request_validator.client_authentication_required(request):
-                log.debug('Authenticating client, %r.', request)
-                if not self.request_validator.authenticate_client(request):
-                    log.debug('Client authentication failed, %r.', request)
-                    raise errors.InvalidClientError(request=request)
-            elif not self.request_validator.authenticate_client_id(request.client_id, request):
-                log.debug('Client authentication failed, %r.', request)
-                raise errors.InvalidClientError(request=request)
             log.debug('Validating access token request, %r.', request)
             self.validate_token_request(request)
         except errors.OAuth2Error as e:
@@ -175,23 +167,18 @@ class ResourceOwnerPasswordCredentialsGrant(GrantTypeBase):
         if not request.grant_type == 'password':
             raise errors.UnsupportedGrantTypeError(request=request)
 
+        self.validate_client_authentication(request)
+
         log.debug('Validating username %s.', request.username)
         if not self.request_validator.validate_user(request.username,
                                                     request.password, request.client, request):
             raise errors.InvalidGrantError(
                 'Invalid credentials given.', request=request)
-        elif not hasattr(request.client, 'client_id'):
-            raise NotImplementedError(
-                'Validate user must set the '
-                'request.client.client_id attribute '
-                'in authenticate_client.')
         log.debug('Authorizing access to user %r.', request.user)
 
         # Ensure client is authorized use of this grant type
         self.validate_grant_type(request)
 
-        if request.client:
-            request.client_id = request.client_id or request.client.client_id
         self.validate_scopes(request)
 
         for validator in self.custom_validators.post_token:

{oauthlib-3.3.0 → oauthlib-4.0.0}/oauthlib/oauth2/rfc6749/parameters.py

@@ -172,7 +172,7 @@ def prepare_token_request(grant_type, body='', include_client_id=True, code_veri
 
 
 def prepare_token_revocation_request(url, token, token_type_hint="access_token",
-        callback=None, body='', **kwargs):
+        body='', **kwargs):
     """Prepare a token revocation request.
 
     The client constructs the request by including the following parameters
@@ -216,17 +216,16 @@ def prepare_token_revocation_request(url, token, token_type_hint="access_token",
     if token_type_hint:
         params.append(('token_type_hint', token_type_hint))
 
+    if 'callback' in kwargs:
+        raise TypeError("prepare_token_revocation_request() got an unexpected keyword argument 'callback'")
+
     for k in kwargs:
         if kwargs[k]:
             params.append((str(k), kwargs[k]))
 
     headers = {'Content-Type': 'application/x-www-form-urlencoded'}
 
-    if callback:
-        params.append(('callback', callback))
-        return add_params_to_uri(url, params), headers, body
-    else:
-        return url, headers, add_params_to_qs(body, params)
+    return url, headers, add_params_to_qs(body, params)
 
 
 def parse_authorization_code_response(uri, state=None):
@@ -339,7 +338,7 @@ def parse_implicit_response(uri, state=None, scope=None):
     if 'scope' in params:
         params['scope'] = scope_to_list(params['scope'])
 
-    vin, vat, v_at = parse_expires(params)
+    vin, vat, _v_at = parse_expires(params)
     if vin:
         params['expires_in'] = vin
     elif 'expires_in' in params:
@@ -430,7 +429,7 @@ def parse_token_response(body, scope=None):
     if 'scope' in params:
         params['scope'] = scope_to_list(params['scope'])
 
-    vin, vat, v_at = parse_expires(params)
+    vin, vat, _v_at = parse_expires(params)
     if vin:
         params['expires_in'] = vin
     elif 'expires_in' in params:
@@ -476,7 +475,7 @@ def parse_expires(params):
     """Parse `expires_in`, `expires_at` fields from params
 
     Parse following these rules:
-    - `expires_in` must be either blank or a valid integer.
+    - `expires_in` must be either integer, float or None. If a float, it is converted into an integer.
     - `expires_at` is not in specification so it does its best to:
       - convert into a int, else
       - convert into a float, else
@@ -495,14 +494,16 @@ def parse_expires(params):
     if 'expires_in' in params:
         if isinstance(params.get('expires_in'), int):
             expires_in = params.get('expires_in')
+        elif isinstance(params.get('expires_in'), float):
+            expires_in = int(params.get('expires_in'))
         elif isinstance(params.get('expires_in'), str):
             try:
                 # Attempt to convert to int
                 expires_in = int(params.get('expires_in'))
             except ValueError:
-                raise ValueError("expires_int must be an int")
+                raise ValueError("expires_in must be an int")
         elif params.get('expires_in') is not None:
-            raise ValueError("expires_int must be an int")
+            raise ValueError("expires_in must be an int")
 
     if 'expires_at' in params:
         if isinstance(params.get('expires_at'), (float, int)):