Back to milestones

OAuth 2.1 authorization server

Open

No due date

•Last updated Oct 8, 2026

Build an OpenIddict-based authorization server so third-party clients can authenticate. Epic #788 holds the decision and the slice order. This milestone tracks completion.

33% complete

OAuth slice 6: audit provenance — record which application acted, alongside the human
mforce/cluckwork#800 · opened on Sep 13, 2026 · OAuth 2.1 authorization server
2
OAuth slice 5: connected-apps screens — user's own, and the Owner's farm-wide view
mforce/cluckwork#799 · opened on Sep 13, 2026 · OAuth 2.1 authorization server
2
OAuth slice 4: consent screen, with step-up and return-URL validation
mforce/cluckwork#798 · opened on Sep 13, 2026 · OAuth 2.1 authorization server
3
OAuth slice 2: fail-closed checks on the OAuth path (disabled, suspended, must-change-password, flock scope, rate limit)
mforce/cluckwork#796 · opened on Sep 13, 2026 · OAuth 2.1 authorization server
2
Build an OAuth 2.1 authorization server (OpenIddict) so MCP clients can authenticate
mforce/cluckwork#788 · opened on Sep 12, 2026 · OAuth 2.1 authorization server
7
Consider migrating the SPA's hand-rolled login to OpenIddict once it is proven for MCP
mforce/cluckwork#793 · opened on Sep 12, 2026 · OAuth 2.1 authorization server
4