Skip to content

feat(clients): show and set PKCE and nonce requirements, warn when both are off - #338

Merged
Bccorb merged 1 commit into
mainfrom
feat/clients-pkce-nonce
Nov 1, 2026
Merged

Bccorb merged 1 commit into
mainfrom
feat/clients-pkce-nonce

Conversation

@Bccorb

@Bccorb Bccorb commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

What

  • seamless clients get shows PKCE: required | not required and nonce: required | not required.
  • seamless clients create and update accept --pkce/--no-pkce and --nonce/--no-nonce. The shared @seamless-auth/types schema checks the API's rules before the request is sent: PKCE can be turned off only on a confidential client, and the nonce only once PKCE is off.
  • An application with both off gets a warning on get, create and update. In list its row is marked no PKCE or nonce, followed by a count. Such a client relies only on state and client authentication against authorization code injection.
  • Pins @seamless-auth/types 0.34.0-next.4, where both fields are required in application responses.
  • Help text and a minor changeset.

Closes #337

Checks

  • npm run build: passes
  • npm test: 1718 passed, 4 skipped
  • npm run coverage: statements 99.05%, branches 96.72%, functions 98.69%, lines 99.32%

@Bccorb
Bccorb merged commit 546649e into main Nov 1, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: show PKCE and nonce settings on applications and warn when both are off

1 participant