feat(OIDC): Add OIDC token exchange endpoint by khvn26 · Pull Request #8043 · Flagsmith/flagsmith

khvn26 · 2026-07-19T16:50:06Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

Contributes to #8040

In this PR, we add a POST /api/v1/auth/oidc/token/ endpoint to support the OIDC exchange flow.

The incoming OIDC token is verified for:

issuer
supported algorithm (RS256/ES256)
signature/expiry
audience and claim rule matching against existing trust relationships.

The short-lived Bearer token is only minted if there's exactly one match: multi-audience tokens matching more than one trust relationship are rejected.

The minted token is a stateless HS256 JWT signed with SECRET_KEY. It's valid for a configurable lifetime, 1 hour by default.

A new TrustRelationshipTokenAuthentication auth class resolves it to the trust relationship's backing master API key and authenticates the request as APIKeyUser. RBAC and permissions come for free.

Also:

The endpoint is unauthenticated and has its own throttle scope, 60/min by default.
Minted tokens cannot manage master API keys or trust relationships.

How did you test this code?

Added new unit and integration tests.

vercel · 2026-07-19T16:50:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 20, 2026 12:51pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ignored	Preview	Jul 20, 2026 12:51pm
flagsmith-frontend-staging	Ignored	Preview	Jul 20, 2026 12:51pm

coderabbitai · 2026-07-19T16:50:19Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0ea443c4-9c2f-4d37-8d77-2b751b052ba9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-19T16:51:08Z

Docker builds report

Image	Build Status	Security report
`ghcr.io/flagsmith/flagsmith-api-test:pr-8043`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-api-test:pr-8043`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-e2e:pr-8043`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-e2e:pr-8043`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-frontend:pr-8043`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-frontend:pr-8043`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-api:pr-8043`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith:pr-8043`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-8043`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-8043`	Finished ✅	Results ✅

github-actions · 2026-07-19T17:02:02Z

Visual Regression

19 screenshots compared. See report for details.
View full report

coderabbitai

Actionable comments posted: 3

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d4edbb9c-172b-4ab1-85d2-3514610b852e

📥 Commits

Reviewing files that changed from the base of the PR and between 2d6ed9e and dde4062.

📒 Files selected for processing (23)

api/api_keys/views.py
api/app/settings/common.py
api/app/settings/test.py
api/custom_auth/urls.py
api/tests/integration/trust_relationships/conftest.py
api/tests/integration/trust_relationships/test_token_exchange.py
api/tests/test_helpers.py
api/tests/unit/trust_relationships/conftest.py
api/tests/unit/trust_relationships/test_authentication.py
api/tests/unit/trust_relationships/test_oidc.py
api/tests/unit/trust_relationships/test_services.py
api/tests/unit/trust_relationships/test_token_exchange.py
api/trust_relationships/authentication.py
api/trust_relationships/constants.py
api/trust_relationships/dataclasses.py
api/trust_relationships/exceptions.py
api/trust_relationships/oidc.py
api/trust_relationships/serializers.py
api/trust_relationships/services.py
api/trust_relationships/types.py
api/trust_relationships/views.py
docs/docs/deployment-self-hosting/observability/_events-catalogue.md
openapi.yaml

POST /api/v1/auth/oidc/token/ validates an external OIDC token (signature via issuer JWKS, expiry, audience, configured claim rules) against the organisation's trust relationships and mints a short-lived HS256 access token. The token resolves to the trust relationship's backing master API key at request time, so revocation and role changes apply to outstanding tokens immediately. beep boop

The exchanged token's `iss` claim was stripped of a trailing slash before the trust relationship lookup, so an issuer registered with the exact (slashed) value it presents — as Auth0 does — never matched and the exchange failed. Preserve the exact `iss` for the lookup and strip the slash only when composing the OIDC discovery URL. beep boop

github-actions · 2026-07-20T12:58:37Z

✅ private-cloud · depot-ubuntu-latest-16 — run #18526 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
53.7 seconds
4359ae5
🔄 Run: #18526 (attempt 1)

🗂️ Previous results

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #18525 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
7.7 seconds
4359ae5
🔄 Run: #18525 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #18525 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

3 passed

Details

3 tests across 3 suites
32 seconds
4359ae5
🔄 Run: #18525 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #18526 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
6.6 seconds
4359ae5
🔄 Run: #18526 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #18525 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
46.5 seconds
4359ae5
🔄 Run: #18525 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #18526 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
41.9 seconds
4359ae5
🔄 Run: #18526 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #18525 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
41.1 seconds
4359ae5
🔄 Run: #18525 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #18526 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
34.4 seconds
4359ae5
🔄 Run: #18526 (attempt 1)

khvn26 requested review from a team as code owners July 19, 2026 16:50

khvn26 requested review from emyller and removed request for a team July 19, 2026 16:50

github-actions Bot added api Issue related to the REST API docs Documentation updates labels Jul 19, 2026

vercel Bot deployed to Preview – docs July 19, 2026 16:50 View deployment

khvn26 changed the title ~~feat(trust-relationships): Add OIDC token exchange endpoint~~ feat(OIDC): Add OIDC token exchange endpoint Jul 19, 2026

github-actions Bot added feature New feature or request and removed docs Documentation updates labels Jul 19, 2026

khvn26 force-pushed the feat/oidc-token-exchange branch from a9bf1ff to 5478a2a Compare July 19, 2026 16:54

khvn26 requested a review from a team as a code owner July 19, 2026 16:54

khvn26 force-pushed the feat/trust-relationships-model branch from 4ea4cd6 to 70667c2 Compare July 19, 2026 16:54

github-actions Bot added the docs Documentation updates label Jul 19, 2026

vercel Bot deployed to Preview – docs July 19, 2026 16:55 View deployment

github-actions Bot added feature New feature or request and removed feature New feature or request docs Documentation updates labels Jul 19, 2026

khvn26 force-pushed the feat/oidc-token-exchange branch from 5478a2a to b88bd0c Compare July 19, 2026 17:00

khvn26 force-pushed the feat/trust-relationships-model branch from 70667c2 to 5220d77 Compare July 19, 2026 17:00

This comment was marked as outdated.

Sign in to view

github-actions Bot added the docs Documentation updates label Jul 19, 2026

vercel Bot deployed to Preview – docs July 19, 2026 17:01 View deployment

github-actions Bot added feature New feature or request and removed feature New feature or request docs Documentation updates labels Jul 19, 2026

github-actions Bot added feature New feature or request and removed docs Documentation updates feature New feature or request labels Jul 19, 2026

coderabbitai Bot reviewed Jul 19, 2026

View reviewed changes

Comment thread api/trust_relationships/authentication.py

Comment thread api/trust_relationships/authentication.py

Comment thread api/trust_relationships/services.py Outdated

khvn26 force-pushed the feat/trust-relationships-model branch 2 times, most recently from 4a9b748 to 94dff4e Compare July 20, 2026 10:03

khvn26 force-pushed the feat/oidc-token-exchange branch from dde4062 to 11cd374 Compare July 20, 2026 10:19

github-actions Bot added the docs Documentation updates label Jul 20, 2026

vercel Bot deployed to Preview – docs July 20, 2026 10:20 View deployment

github-actions Bot added feature New feature or request and removed feature New feature or request docs Documentation updates labels Jul 20, 2026

khvn26 force-pushed the feat/trust-relationships-model branch from 94dff4e to 1c5bc06 Compare July 20, 2026 10:23

khvn26 force-pushed the feat/oidc-token-exchange branch from 11cd374 to 2d8d889 Compare July 20, 2026 10:23

github-actions Bot added the docs Documentation updates label Jul 20, 2026

vercel Bot deployed to Preview – docs July 20, 2026 10:24 View deployment

github-actions Bot added feature New feature or request docs Documentation updates and removed feature New feature or request docs Documentation updates labels Jul 20, 2026

khvn26 and others added 3 commits July 20, 2026 13:50

chore: Update documentation artefacts

4359ae5

Uh oh!

Conversation

khvn26 commented Jul 19, 2026

Changes

How did you test this code?

Uh oh!

vercel Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docker builds report

Uh oh!

This comment was marked as outdated.

github-actions Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Visual Regression

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Jul 19, 2026 •

edited

Loading

coderabbitai Bot commented Jul 19, 2026 •

edited

Loading

github-actions Bot commented Jul 19, 2026 •

edited

Loading

github-actions Bot commented Jul 19, 2026 •

edited

Loading

github-actions Bot commented Jul 20, 2026 •

edited

Loading