Issues

• Docs: exp on the config JWT is never enforced, and typ is never validated

  UnlikeOtherAI/UnlikeOtherAuthenticator#40 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: undocumented bounds on session TTLs and a required org role

  UnlikeOtherAI/UnlikeOtherAuthenticator#39 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: ui_theme.logo.alt is mandatory and non-empty even with an empty logo.url

  UnlikeOtherAI/UnlikeOtherAuthenticator#38 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: auto-onboarding needs domain + jwks_url + contact_email together, and says so nowhere

  UnlikeOtherAI/UnlikeOtherAuthenticator#37 · Filter by author rafiki270 opened on Aug 3, 2026

• Capability: no way to read a subject's current token_version (tv)

  UnlikeOtherAI/UnlikeOtherAuthenticator#36 · Filter by author rafiki270 opened on Aug 3, 2026

• Capability: no self-service tariff selection — checkout takes no plan parameter

  UnlikeOtherAI/UnlikeOtherAuthenticator#35 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: mention the second credential delivery mode (deliveryMode: 'reveal')

  UnlikeOtherAI/UnlikeOtherAuthenticator#34 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: client_hash derivation needs the exact normalisation rule

  UnlikeOtherAI/UnlikeOtherAuthenticator#33 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: state operational constraints — no CORS, and the token rate limit is per-instance

  UnlikeOtherAI/UnlikeOtherAuthenticator#31 · Filter by author rafiki270 opened on Aug 3, 2026

• Capability gap: no erase operation, which blocks GDPR erasure for consuming products

  UnlikeOtherAI/UnlikeOtherAuthenticator#32 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: firstLogin availability and shape are underspecified

  UnlikeOtherAI/UnlikeOtherAuthenticator#30 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: config JWT required-field set is inaccurate (onboarding vs ongoing)

  UnlikeOtherAI/UnlikeOtherAuthenticator#29 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: the access token carries an undocumented tv claim that consumers depend on

  UnlikeOtherAI/UnlikeOtherAuthenticator#28 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: every /org/* route requires ?domain=, which the guide omits entirely

  UnlikeOtherAI/UnlikeOtherAuthenticator#27 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: there is no POST /auth/refresh — refresh is a grant on /auth/token

  UnlikeOtherAI/UnlikeOtherAuthenticator#26 · Filter by author rafiki270 opened on Aug 3, 2026

• Docs: /auth/token rejects redirect_uri, but the guide says it is accepted

  UnlikeOtherAI/UnlikeOtherAuthenticator#25 · Filter by author rafiki270 opened on Aug 3, 2026