pypi / oauthlib
oauthlib
What changed in oauthlib 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-26.
16 breaking2 security1 deprecations8 new APIs and options1 behavior and defaults4 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initoauthlib 45 changes
Breaking changes 2
The grant_type parameter is validated before client authentication.
JSONP support was removed from the token revocation endpoint.
Security 2
Client authentication when getting a token was fixed for DeviceCodeGrant.
PKCE code comparison was improved.
New APIs and options 1
Request._params now includes resource.
oauthlib 327 changes
Breaking changes 14
The status code for access_denied changed from 401 to 400.
The behavior of confirm_redirect_uri changed.
The status code for consent_required changed from 401 to 400.
expires no longer overrides expires_in.
expires_in in the Implicit flow is now an integer.
The behavior of get_default_redirect_uri changed.
invalid_client is now a FatalError.
The status code for invalid_grant changed from 401 to 400.
The status code for invalid_scope changed from 401 to 400.
The status code for login_required changed from 401 to 400.
parse_request_uri_response is now required.
Request attributes are no longer overridden by HTTP Headers.
The status code for unauthorized_client changed from 401 to 400.
A 401 response must include the WWW-Authenticate HTTP Header.
Deprecations 1
Passing client_id to WebApplicationClient.prepare_request_body emits a DeprecationWarning; use the already configured self.client_id instead.
New APIs and options 7
Adds request to confirm_redirect_uri.
Adds HMAC-SHA256 support for the OAuth1.0 Client.
WebApplicationClient.prepare_request_body adds the include_client_id keyword argument to control whether client_id is sent; it defaults to included.
Adds OpenID Connect Core support to the OAuth2.0 Provider.
Adds RFC7636 PKCE support to the OAuth2.0 Provider.
Adds RFC7662 Introspect support to the OAuth2.0 Provider.
Adds RFC8414 OAuth2.0 Authorization Server Metadata support to the OAuth2.0 Provider.
Behavior and default changes 1
pytest is set as the default unittest framework.
Fixes and other changes 4
Empty scopes no longer raise exceptions for implicit and authorization_code.
prepare_token_request supports sending an empty string for client_id.
Adds support for Python 3.7.
$ and ' are allowed to be unencoded in query strings.