Authlib 1.8

Apply these rules to Authlib 1.8 OAuth 2.0 and OpenID Connect clients, authorization servers, and protected resources. This pack includes Python 3.14. When the application uses Flask, Django, Starlette, or FastAPI, also apply that framework's prompt for its installed version. When writing low-level JOSE code, also apply the joserfc prompt for its installed version.

Client registration and browser transactions

• Register providers with trusted server_metadata_url, issuer, endpoints, client ID, and credentials. Bind each login transaction to its selected provider; for multiple issuers, validate the authorization-response issuer or use distinct provider callbacks. Do not choose discovery or token endpoints from callback parameters.
• Build callback and post-logout URLs from an approved public origin and exact registered paths. Configure the host framework's trusted hosts and proxy headers before using url_for or request.build_absolute_uri; untrusted Host or forwarding headers must not select an OAuth destination.
• Use authorize_redirect and authorize_access_token together with a persistent browser session. Keep state, nonce, verifier, provider, and redirect binding private, short-lived, and single-use. A configured shared cache does not replace the browser session required for state binding; reject missing or mismatched state before linking an account.
• For a low-level OAuth2Session, save the state returned by create_authorization_url for that browser transaction, restore it into the callback session, and pass the full authorization_response to