feat: add mTLS (RFC 8705) client authentication - #159

Open

cschetan77 wants to merge 20 commits into

mainfrom

feat/mtls-client-authentication

Commits on Aug 31, 2026

feat: add use_mtls and ssl_context constructor args with validation
cschetan77
committed
7fbe52a
feat: pass mTLS ssl_context to httpx and authlib clients
cschetan77
committed
19b1484
feat: add _resolve_token_endpoint mTLS alias resolver
cschetan77
committed
7f18573
feat: return no body credential under mTLS in client auth resolver
cschetan77
committed
8acc86b
feat: route all token-endpoint calls through mTLS alias resolver
cschetan77
committed
be1fee8
feat: reject dpop_key + use_mtls in signin_with_passkey
cschetan77
committed
8f786c9
feat: warn when mTLS token lacks cnf.x5t#S256 binding
cschetan77
committed
3849b96
feat: thread mTLS ssl_context and alias routing through MFA verify
cschetan77
committed
09bf72f
docs: document mTLS client authentication
cschetan77
committed
5758f63
docs: document token_endpoint_override and dpop+mTLS ConfigurationError in docstrings
cschetan77
committed
14430d6
style: apply repo conventions to mTLS code and docs
cschetan77
committed
0398bc6
refactor(tests): distribute mTLS tests next to their surfaces
cschetan77
committed
f557dd1
docs: link to Auth0 mTLS configuration docs in README
cschetan77
committed
2f26875
fix: route mTLS token calls through alias resolver in MFA, passwordless, and interactive login
cschetan77
committed
5bc3fec
refactor: replace cnf.x5t#S256 UserWarning with documentation
cschetan77
committed
4a03a5a
docs: document passkey challenge/register incompatibility with mTLS-only configuration
cschetan77
committed
e620c26
feat: wire ssl_context through MyAccountClient for mTLS cert-bound token support
cschetan77
committed
9cd5951

Navigation Menu

Uh oh!

feat: add mTLS (RFC 8705) client authentication - #159

feat: add mTLS (RFC 8705) client authentication#159
cschetan77 wants to merge 20 commits into
mainfrom
feat/mtls-client-authentication

Commits on Aug 31, 2026

feat: add use_mtls and ssl_context constructor args with validation

feat: pass mTLS ssl_context to httpx and authlib clients

feat: add _resolve_token_endpoint mTLS alias resolver

feat: return no body credential under mTLS in client auth resolver

feat: route all token-endpoint calls through mTLS alias resolver

feat: reject dpop_key + use_mtls in signin_with_passkey

feat: warn when mTLS token lacks cnf.x5t#S256 binding

feat: thread mTLS ssl_context and alias routing through MFA verify

docs: document mTLS client authentication

docs: document token_endpoint_override and dpop+mTLS ConfigurationError in docstrings

style: apply repo conventions to mTLS code and docs

refactor(tests): distribute mTLS tests next to their surfaces

docs: link to Auth0 mTLS configuration docs in README

fix: route mTLS token calls through alias resolver in MFA, passwordless, and interactive login

refactor: replace cnf.x5t#S256 UserWarning with documentation

docs: document passkey challenge/register incompatibility with mTLS-only configuration

feat: wire ssl_context through MyAccountClient for mTLS cert-bound token support

Commits on Sep 1, 2026

fix: route PAR endpoint through mTLS alias when use_mtls is enabled

test: add mTLS token endpoint routing assertions for refresh, backchannel, connection, and custom-exchange flows

docs: document use_mtls and ssl_context in ServerClient.init docstring