Starstruk Logo MarkStarstruk

backend/v2.2.0

teamhanko/hankobackend/v2.2.0Oct 28, 2025by FlxMgdnz

AI Summary

This release introduces PKCE (Proof Key for Code Exchange) support for third-party OAuth flows, enabling better compatibility with mobile apps where cookies may not be stored, and adding support for the oauth_state code_verifier parameter.

Key Highlights

  • PKCE support for third-party OAuth flows
  • code_verifier parameter support for mobile apps
  • State cookie becomes optional when code_verifier is used

New Features

  • PKCE OAuth flow support
  • code_verifier parameter in thirdparty_oauth action
  • OIDC ACR values support

Full Release Notes

## PKCE (Proof Key for Code Exchange)
The main feature of this release is PKCE support for 3rd-party OAuth flows of the Hanko API. When using Hanko with a mobile app, the `oauth_state` cookie might not be stored, so the `thirdparty_oauth` action now accepts a `code_verifier`. When the `code_verifier` ist set, the state cookie is optional, but the `code_verifier` is required when exchanging the Hanko token with the `exchange_token` action.

## What's Changed
* fix: user verification on passkey creation by @lfleischmann in https://github.com/teamhanko/hanko/pull/2239
* fix: change module name corresponding to version by @FreddyDevelop in https://github.com/teamhanko/hanko/pull/2257
* fix: export the Claims type by @FreddyDevelop in https://github.com/teamhanko/hanko/pull/2268
* fix: check for SAML before email existence by @FreddyDevelop in https://github.com/teamhanko/hanko/pull/2270
* Feat oauth prompt by @FreddyDevelop in https://github.com/teamhanko/hanko/pull/2260
* PKCE OAuth flow by @FreddyDevelop in https://github.com/teamhanko/hanko/pull/2266

**Full Changelog**: https://github.com/teamhanko/hanko/compare/backend/v2.1.1...backend/v2.2.0