Changelog

v0.4.0 (2026-11-07)

Now requires Elixir 1.18 / OTP 26.

Breaking changes

• Assent.HTTPAdapter.Finch removed
• JSON is now the default JSON library
• Assent.Strategy.Instagram removed because the Instagram Basic Display API has been discontinued
• Exceptions and Assent.HTTPAdapter.HTTPResponse now omit potentially sensitive fields from their default Inspect output
• Assent.Strategy.OIDC now requires :userinfo_signed_response_alg for signed UserInfo responses
• The following exceptions have been renamed:
  • Assent.CallbackError to Assent.Strategy.CallbackError, now with :params field instead of :error and :error_uri
  • Assent.CallbackCSRFError to Assent.Strategy.CallbackCSRFError
  • Assent.CastClaimsError to Assent.Strategy.CastError
  • Assent.RequestError to Assent.HTTPAdapter.RequestError
  • Assent.InvalidResponseError to Assent.HTTPAdapter.InvalidResponseError
  • Assent.UnexpectedResponseError to Assent.HTTPAdapter.UnexpectedResponseError
  • Assent.ServerUnreachableError to Assent.HTTPAdapter.ServerUnreachableError
• Strategies now return exceptions instead of error strings: Assent.MissingParamError for missing parameters and ArgumentError for configuration errors
• Assent.Strategy.OAuth2 now returns Assent.Strategy.OAuth2.UnsupportedTokenTypeError for unsupported token types
• Assent.Strategy.OIDC now returns:
  • Assent.Strategy.OIDC.InvalidOpenIDConfigurationError for invalid provider configuration
  • Assent.Strategy.OIDC.InvalidIDTokenError for invalid ID Tokens
  • Assent.Strategy.OIDC.InvalidUserInfoError for invalid UserInfo responses
• Assent.Strategy.Telegram now returns ArgumentError for an invalid :authorization_channel
• Assent.HTTPAdapter.HTTPResponse replaces its :request_url field with a :request field containing an Assent.HTTPAdapter.HTTPRequest struct
• Assent.JWTAdapter.AssentJWT.Error replaces its :message field with structured :action, :part, and :reason fields
• Assent.HTTPAdapter.Httpc now verifies SSL certificates with the OS trust store and OTP's built-in hostname verification, :certifi and :ssl_verify_fun are no longer used
• Assent.HTTPAdapter.Httpc now raises ArgumentError on HTTPS requests configured with verify: :verify_none
• Assent.HTTPAdapter.Httpc and Assent.HTTPAdapter.Req no longer follow redirects by default

Changes

• :inets and :ssl are now started automatically by Assent, and no longer required in :extra_applications
• Assent.JWTAdapter.AssentJWT now supports EdDSA algorithms
• Assent.JWTAdapter.AssentJWT now supports EC JWKs
• Assent.Strategy.OIDC no longer rejects a :client_authentication_method missing from the provider's token_endpoint_auth_methods_supported
• Assent.Strategy.OIDC accepts additional ID Token issuers via the :trusted_issuers config option
• Assent.Strategy.OIDC now validates iss and aud for signed UserInfo responses
• Assent.Strategy.Facebook now requests the user picture field
• Strategies now accept a :prepare_http_request configuration option for rewriting HTTP requests
• Assent.HTTPAdapter.request/5 is deprecated in favor of Assent.HTTPAdapter.request/2
• Assent.Strategy.Apple now returns is_private_email, real_user_status, and org_id in the user info
• Assent.Strategy.cast_claims/2 was added to support casting provider-specific claims
• Assent.Strategy.OAuth2.grant_access_token/3 accepts :jwt_audience for JWT client authentication
• Assent.Strategy.OAuth2 deprecates the :auth_method configuration option in favor of :client_authentication_method
• Assent.Strategy.OIDC deprecates string values for the :client_authentication_method configuration option in favor of atoms

Bug fixes

• Assent.Strategy.OAuth no longer lowercases the request path for signature base string, per RFC 5849 3.4.1.2
• Assent.HTTPAdapter.Req now returns the response headers instead of the request headers
• Assent.Strategy.OIDC now rejects dynamically fetched OpenID configuration when issuer does not match the issuer URL
• Assent.Strategy.OAuth2.callback/2 now validates the state parameter before handling error responses
• Assent.Strategy.OIDC.authorize_url/1 now generates a random nonce when :nonce is set to true
• Assent.Strategy.OAuth.authorize_url/1 now validates oauth_callback_confirmed in request token responses
• Assent.Strategy.OAuth.callback/2 now validates the oauth_token parameter
• Assent.Strategy.Telegram.callback/2 now verifies hash before verifying auth_date
• Assent.Strategy.OAuth2.grant_access_token/3 now encodes client_secret_basic credentials as x-www-form-urlencoded
• Assent.Strategy.OAuth2.grant_access_token/3 now uses the token endpoint URL as the default aud for JWT client authentication
• Assent.Strategy.OAuth2.grant_access_token/3 now includes a unique jti in JWT client authentication
• Assent.Strategy.Facebook now uses Graph API v26.0
• Assent.Strategy.VK now uses API v5.199 and only requests supported user fields
• Assent.Strategy.VK now merges :user_url_params with the default fields and v request params instead of dropping them
• Assent.Strategy.Discord now uses the API v10 endpoints
• Assent.Strategy.Bitbucket and Assent.Strategy.Spotify now use client_secret_basic authentication
• Assent.Strategy.LINE now uses client_secret_post authentication
• Assent.Strategy.Apple no longer allows unverified user callback parameters to override identity claims

v0.3

The CHANGELOG for v0.3 releases can be found in the v0.2 branch.