0.1.0 — 2026-10-24

This page lists what TessariDB OAuth 0.1.0, released on 2026-10-24, brings. It is the first release, in alpha: the configuration and the HTTP surface may still change in a minor release before 1.0. Each released version keeps its own copy of these pages, so choosing an older version in the version picker shows what that version changed. The complete history is the CHANGELOG.

It needs TessariDB 0.38.2 or later.

Added

• An authorization server and OpenID provider per company: discovery and key set, authorization with PKCE S256 and pushed requests, codes, refresh tokens and client credentials, revocation, UserInfo and logout. See Authorization and Tokens.
• Clients without shared secrets: private_key_jwt (EdDSA or ES256) or public. See Clients.
• Codes redeem once; a replayed code or a reused refresh token revokes the refresh family. DPoP-bound tokens, five-minute access tokens addressed to one resource, pairwise subjects.
• Sign-in with passwords, authenticator apps, recovery codes and passkeys; new passwords screened against breached passwords; holds that end by themselves instead of lockouts. See Signing in.
• The account portal and the admin console on its own listener. See The account portal and The admin console.
• The audit trail on a TessariDB topic kept 400 days, and regions with home-region redirects. See The audit trail and Regions.
• A container image, tessaridb/oauth, for linux/amd64 and linux/arm64.