v1.3.5

THU-MAIC/OpenMAICv1.3.5Aug 7, 2026by harijoe

AI Summary

Resolves a DevTools OAuth failure when using hosted authorization servers by correcting the scoping of x-forwarded-* headers during cross-origin discovery.

Key Highlights

Fixes OAuth flow for hosted servers (WorkOS, Auth0, Clerk, Stytch)
Scopes forwarded headers to the MCP server origin

Full Release Notes

Fixes the DevTools OAuth flow against a hosted authorization server (WorkOS AuthKit, Auth0, Clerk, Stytch). DevTools sent its `x-forwarded-*` headers on the cross-origin discovery, registration and token requests too, so the browser preflighted them and the flow stopped at `.well-known/openid-configuration`.

## Changes

- fix(devtools): scope forwarded headers to the MCP server origin @muralx (#1024)