feat(client): SEP-1933 workload identity federation via the jwt-bearer grant - #2572

Open

coding-bobo wants to merge 17 commits into

modelcontextprotocol:mainfrom

coding-bobo:feat/wif-workload-identity-provider

Commits on Jul 28, 2026

feat(client): add WorkloadIdentityProvider for SEP-1933 workload identity federation

coding-bobo
and
claude
committed
feat(client): fail loudly on replayed workload assertions

coding-bobo
and
claude
committed
test(client): cover WorkloadIdentityProvider failure paths through the auth() flow

coding-bobo
and
claude
committed
feat(client): export WorkloadIdentityProvider from package root

coding-bobo
and
claude
committed
test(conformance): wire WorkloadIdentityProvider into auth/wif-jwt-bearer and un-baseline it

coding-bobo
and
claude
committed
docs(examples): add self-verifying workload identity federation example

coding-bobo
and
claude
committed
docs(client): document WorkloadIdentityProvider and add changeset

coding-bobo
and
claude
committed
fix(client): key workload assertion rejection memory off credential invalidation

coding-bobo
and
claude
committed
fix(client): keep rejection memory armed after concurrent success

coding-bobo
and
claude
committed
fix: address review feedback on invalidation scopes and example AS policy

coding-bobo
and
claude
committed
docs: clarify clientId as an SDK constraint and soften wif-no-retry attribution

coding-bobo
and
claude
committed
docs(examples): correct audience attribution and assertion-source claims in WIF readme

coding-bobo
and
claude
committed
refactor: compress comment blocks to their load-bearing facts

coding-bobo
and
claude
committed
test(client): fold redundant workload identity tests into their canonical peers

coding-bobo
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(client): SEP-1933 workload identity federation via the jwt-bearer grant - #2572

feat(client): SEP-1933 workload identity federation via the jwt-bearer grant#2572
coding-bobo wants to merge 17 commits into
modelcontextprotocol:mainfrom
coding-bobo:feat/wif-workload-identity-provider

Commits on Jul 28, 2026

feat(client): add WorkloadIdentityProvider for SEP-1933 workload identity federation

feat(client): fail loudly on replayed workload assertions

test(client): cover WorkloadIdentityProvider failure paths through the auth() flow

feat(client): export WorkloadIdentityProvider from package root

test(conformance): wire WorkloadIdentityProvider into auth/wif-jwt-bearer and un-baseline it

docs(examples): add self-verifying workload identity federation example

docs(client): document WorkloadIdentityProvider and add changeset

fix(client): key workload assertion rejection memory off credential invalidation

fix(client): keep rejection memory armed after concurrent success

fix: address review feedback on invalidation scopes and example AS policy

docs: clarify clientId as an SDK constraint and soften wif-no-retry attribution

docs(examples): correct audience attribution and assertion-source claims in WIF readme

refactor: compress comment blocks to their load-bearing facts

test(client): fold redundant workload identity tests into their canonical peers

Commits on Jul 29, 2026

refactor(client): surface workload assertion replay refusal as a typed error

fix(client): recommend issuer pinning for fixed-audience assertions and cover invalid_client

docs: correct saveAuthorizationServerUrl timing doc and note static-assertion recovery