Recommended upgrade path

<PackageReference Include="OAuth2" Version="1.1.0" />

Highlights

• Added a net11.0 target and updated RestSharp to 114.1.0.
• Added nullable UserInfo.EmailVerified and provider-specific UserInfo.ProviderData, including Google's hd claim.
• Updated provider requests and response handling, including DigitalOcean, ExactOnline, Uber, and Yahoo.
• Shared the default HTTP transport across clients and blocked cross-origin redirects to protect OAuth credentials.
• Expanded provider, request, serialization, and transport regression coverage.

Breaking changes and migration

.NET 8 target removed

The dedicated net8.0 asset has been removed because .NET 8 has reached end of support. The package now targets netstandard2.0, net10.0, and net11.0. Compatible .NET 8 applications can resolve the netstandard2.0 asset, but should upgrade to a supported runtime and verify dependency compatibility. That asset now has an explicit System.Text.Json 11.0.0 dependency.

Provider identity and endpoint changes

• DigitalOcean: UserInfo.ProviderName is now DigitalOcean, and current responses use info.uuid as UserInfo.Id when the legacy uid is absent. Applications storing a numeric ID or null provider name need a trusted account-link check; do not link by email alone.
• Uber: UserInfo requests use /v3/me, with sub mapped to UserInfo.Id. Applications that linked users with another key need a trusted migration. Profile fields require the profile scope and an approved application.
• Yahoo: UserInfo requests use /openid/v1/userinfo. Configure openid profile email for names and email. The UserInfo sub is used for UserInfo.Id and UserProfileGUID; a supplied legacy token GUID must match it.
• ExactOnline: The authorization endpoint is now /api/oauth2/auth, and current OData profile responses are mapped. Review redirect and integration configuration.
• Asana: UserInfo requests now request gid, retaining the legacy id parser fallback. Scoped applications need users:read for the user endpoint.

Review stored account identifiers and test the complete sign-in and account-link flow for each affected provider before upgrading. See the provider compatibility guidance.

Redirects, Salesforce URLs, and custom integrations

The default request factory rejects redirects to another scheme, host, or port. Integrations that rely on cross-origin redirects must use the provider's documented endpoint directly or supply an application-owned IRequestFactory with an explicit redirect policy. Salesforce identity URLs must be absolute HTTPS URLs. RestSharp is now 114.1.0; test integrations that use its types or custom request factories directly.

UserInfo serialization

Default System.Text.Json serialization now includes EmailVerified and ProviderData, including null values. Consumers that require an exact JSON schema should review their serialization settings and contracts. Older JSON still deserializes with the new properties set to null.

Email verification and provider claims

EmailVerified preserves a provider's true or false assertion; null means unknown or not mapped. Google, LinkedIn, Salesforce, Uber, Yahoo, and GitHub populate it where their responses supply the relevant claim. GitHub public profile email alone does not establish verification. Google exposes its hosted-domain claim as ProviderData["hd"] and continues to map sub to UserInfo.Id.

Use EmailVerified is true to check an affirmative assertion, and apply the provider's email-authority rules before account linking. Look up linked accounts by ProviderName and UserInfo.Id; email addresses can change or be reassigned. See the email verification guidance.

Reliability and security

• Fixed GitHub token refresh and provider request authentication and signing issues, including Mail.ru and Odnoklassniki.
• Isolated client settings while reusing HTTP connections; on supported desktop/server platforms, connections periodically expire to pick up DNS changes.
• Documented caller responsibility for validating OAuth callback state and using a separate client instance for each authentication flow.
• Added tests for provider response shapes, credentials isolation, redirects, timeouts, and serialization. Provider tests use synthetic responses and do not establish live login compatibility.

Full changelog

Compare: v1.0.0...v1.1.0

This is the first beta release of the upcoming OAuth2 1.0 line.

This release significantly modernizes the library, updates provider integrations, improves diagnostics, adds nullable reference type annotations, updates the build and test infrastructure, and introduces transport-level request options for configuring HTTP behavior.

We are marking this release as beta because the 1.0 API shape is now considered close to stable, but we want real-world validation from existing users before publishing the final stable v1.0.0 release.

Please upgrade, test your OAuth provider flows, and report any provider-specific issues before the stable release.

⚠️ This is a beta release and contains breaking changes. Please validate your OAuth login and callback flows before deploying to production.

Recommended upgrade path

<PackageReference Include="OAuth2" Version="1.0.0-beta1" />

Highlights

• Added multi-targeting for modern .NET:
  • netstandard2.0
  • net8.0
  • net10.0
• Upgraded RestSharp to 114.0.0.
• Replaced Newtonsoft.Json with System.Text.Json.
• Enabled nullable reference types across the library.
• Added RequestOptions for configurable HTTP timeout and future transport settings.
• Added MicrosoftClient for Microsoft Identity Platform v2.0 and Microsoft Graph v1.0.
• Updated and verified provider endpoints across supported providers.
• Added OAuth error code and error description support to UnexpectedResponseException.
• Removed dead providers whose APIs are no longer available.
• Added provider compatibility documentation and provider audit notes.
• Added CodeQL security analysis.
• Added NuGet package README support.
• Expanded and modernized tests.

New: RequestOptions

This release adds a new transport-level RequestOptions type.

RequestOptions currently supports configuring HTTP timeout behavior without adding transport concerns to the OAuth client configuration interfaces.

var options = new RequestOptions
{
    Timeout = TimeSpan.FromSeconds(10)
};

var client = new GoogleClient(factory, configuration, options);

When RequestOptions is omitted or null, behavior remains unchanged and RestSharp defaults are used.

This API intentionally uses BCL types such as TimeSpan? so it is not tied to RestSharp. That gives the library a clean path for future transport improvements without requiring application-level code to change.

Transport note

This release still uses RestSharp internally.

The new RequestOptions abstraction is intentionally transport-agnostic so settings such as timeout can survive a future internal migration away from RestSharp if that should ever happen. If that migration can be done safely without consumer-facing API changes, it may happen before or after v1.0.0 if enough community feedback wants us to go that direction.

Any consumer-facing breaking transport or extensibility changes after v1.0.0 will be reserved for a future major release.

Breaking changes

RestSharp upgraded to 114.0.0

RestSharp was upgraded from the legacy 106.x line to 114.0.0.

This may affect consumers that interact with RestSharp types directly, customize request creation, implement custom request factories, or extend OAuth2 internals.

Newtonsoft.Json removed

OAuth2 no longer depends on Newtonsoft.Json.

Internal JSON parsing now uses System.Text.Json.

This may affect consumers that subclass clients and depend on Newtonsoft-specific behavior in overridden parsing methods.

Nullable reference types enabled

Nullable reference types are now enabled across the library.

Public API surfaces have been annotated to better represent provider data that may be absent or optional.

This may introduce new compiler warnings in consuming projects with nullable reference types enabled. These warnings are intentional and should help identify cases where provider data may be missing.

Examples of newly nullable members include:

• UserInfo and AvatarInfo string properties
• Optional configuration fields such as scope and public client values
• OAuth token and state values
• Provider-specific user/profile fields
• Error response fields
• JSON parsing helper return values

Removed providers

The following clients were removed because their backing APIs are no longer available in their previous form:

• InstagramClient
• XingClient

TwitterClient renamed to XClient

TwitterClient has been replaced by XClient to reflect the provider rename from Twitter to X.

The old TwitterClient name remains as an obsolete compatibility wrapper.

Provider behavior changes

Several providers were updated to current endpoints, schemas, or authorization behavior.

Provider updates include:

• GitHub now uses Bearer authorization instead of the deprecated token authorization scheme.
• Google was updated to v2/v3 endpoints and now uses the sub field from the v3 schema.
• Facebook is pinned to Graph API v25.0.
• LinkedIn was updated to v2 OpenID Connect.
• Todoist was updated to REST API v1.
• VK API version was updated.
• Uber authentication endpoints were updated.
• X user info now includes email where available.
• Microsoft Identity Platform support was added through the new MicrosoftClient.

New features

Microsoft Identity Platform support

Added MicrosoftClient using Microsoft Identity Platform v2.0 and Microsoft Graph v1.0.

This is the preferred path for new Microsoft integrations.

MicrosoftClient is not intended to be a drop-in replacement for every WindowsLiveClient usage.

Configurable HTTP timeout

Added transport-level request options for configuring timeout behavior.

var options = new RequestOptions
{
    Timeout = TimeSpan.FromSeconds(30)
};

This resolves the long-standing need to configure HTTP request timeout behavior without changing OAuth identity configuration.

Improved OAuth error diagnostics

UnexpectedResponseException now captures OAuth callback error details when providers return error and error_description.

For example, when a user denies authorization, consumers can now inspect the actual OAuth error code such as access_denied and the provider-supplied description.

The exception message now includes these details for easier debugging.

Provider updates

This release includes a broad provider audit and modernization pass.

Added

• MicrosoftClient

Removed

• InstagramClient
• XingClient

Renamed

• TwitterClient -> XClient

Updated

• GitHubClient
• GoogleClient
• FacebookClient
• LinkedInClient
• TodoistClient
• UberClient
• VkClient
• XClient

Documented provider status

The README now includes a provider compatibility matrix with provider status, API version, authorization endpoint, and verification notes.

A new provider audit document captures active, legacy, deprecated, rebranded, and removed provider status.

Security and reliability improvements

• Upgraded several provider endpoints from HTTP to HTTPS.
• Added CodeQL workflow for C# security analysis.
• Improved null handling in provider user-info parsing.
• Fixed Asana parsing when users have no profile photo.
• Fixed Odnoklassniki request signing behavior.
• Added additional argument validation in request factory paths.
• Added more defensive JSON parsing.
• Improved OAuth callback error reporting.
• Added more provider serialization and parsing coverage.
• Added missing state and avatar test assertions.

JSON serialization changes

OAuth2 now uses System.Text.Json internally.

Changes include:

• Converted JSON-using providers from Newtonsoft.Json to JsonDocument / JsonElement.
• Converted token response parsing to System.Text.Json.
• Added helper methods for safer string extraction and case-insensitive property access.
• Added guards for null, missing, and unexpected JSON values.
• Added provider-specific serialization and parsing tests.
• Added coverage for numeric IDs, avatar URLs, boolean values, null values, and provider edge cases.

Build and dependency updates

• Converted solution to .slnx.
• Updated target frameworks:
  • Library: netstandard2.0, net8.0, net10.0
  • Tests: modern .NET test targets
• Upgraded RestSharp to 114.0.0.
• Removed Newtonsoft.Json.
• Upgraded MinVer.
• Upgraded NUnit.
• Upgraded NUnit3TestAdapter.
• Upgraded FluentAssertions.
• Upgraded Microsoft.NET.Test.Sdk.
• Upgraded NSubstitute.
• Upgraded AsyncFixer.
• Upgraded Microsoft.SourceLink.GitHub.
• Updated GitHub Actions:
  • actions/checkout
  • actions/setup-dotnet
• Added NuGet package README support.
• Fixed build warnings and warning-as-error issues.

Testing

This release includes a substantial test modernization pass.

Test improvements include:

• Provider-specific JSON serialization coverage.
• Provider parsing regression tests.
• Request factory timeout tests.
• Null handling tests.
• OAuth error response tests.
• Asana null photo regression test.
• Additional WindowsLive avatar and state assertions.
• Additional numeric ID conversion tests.
• Test naming and structure cleanup.

Migration guide

1. Update your package reference

<PackageReference Include="OAuth2" Version="1.0.0-beta1" />

2. Rebuild and review nullable warnings

If your project has nullable reference types enabled, review any new warnings from OAuth2 API usage.

Many provider fields are now correctly annotated as nullable because external OAuth provider data may be missing.

3. Replace removed providers

If you use InstagramClient or XingClient, those clients have been removed because the underlying APIs are no longer available in their previous form.
...

Recommended upgrade path

<PackageReference Include="OAuth2" Version="1.0.0" />

Highlights

• Added multi-targeting for modern .NET:
  • netstandard2.0
  • net8.0
  • net10.0
• Upgraded RestSharp to 114.0.0.
• Replaced Newtonsoft.Json with System.Text.Json.
• Enabled nullable reference types across the library.
• Added RequestOptions for configurable HTTP timeout and future transport settings.
• Added MicrosoftClient for Microsoft Identity Platform v2.0 and Microsoft Graph v1.0.
• Updated and verified provider endpoints across supported providers.
• Added OAuth error code and error description support to UnexpectedResponseException.
• Removed dead providers whose APIs are no longer available.
• Added provider compatibility documentation and provider audit notes.
• Added CodeQL security analysis.
• Added NuGet package README support.
• Expanded and modernized tests.

New: RequestOptions

This release adds a new transport-level RequestOptions type.

RequestOptions currently supports configuring HTTP timeout behavior without adding transport concerns to the OAuth client configuration interfaces.

var options = new RequestOptions
{
    Timeout = TimeSpan.FromSeconds(10)
};

var client = new GoogleClient(factory, configuration, options);

When RequestOptions is omitted or null, behavior remains unchanged and RestSharp defaults are used.

This API intentionally uses BCL types such as TimeSpan? so it is not tied to RestSharp. That gives the library a clean path for future transport improvements without requiring application-level code to change.

Transport note

This release still uses RestSharp internally.

The new RequestOptions abstraction is intentionally transport-agnostic so settings such as timeout can survive a future internal migration away from RestSharp if that should ever happen. If that migration can be done safely without consumer-facing API changes, it may happen before or after v1.0.0 if enough community feedback wants us to go that direction.

Any consumer-facing breaking transport or extensibility changes after v1.0.0 will be reserved for a future major release.

Breaking changes

RestSharp upgraded to 114.0.0

RestSharp was upgraded from the legacy 106.x line to 114.0.0.

This may affect consumers that interact with RestSharp types directly, customize request creation, implement custom request factories, or extend OAuth2 internals.

Newtonsoft.Json removed

OAuth2 no longer depends on Newtonsoft.Json.

Internal JSON parsing now uses System.Text.Json.

This may affect consumers that subclass clients and depend on Newtonsoft-specific behavior in overridden parsing methods.

Nullable reference types enabled

Nullable reference types are now enabled across the library.

Public API surfaces have been annotated to better represent provider data that may be absent or optional.

This may introduce new compiler warnings in consuming projects with nullable reference types enabled. These warnings are intentional and should help identify cases where provider data may be missing.

Examples of newly nullable members include:

• UserInfo and AvatarInfo string properties
• Optional configuration fields such as scope and public client values
• OAuth token and state values
• Provider-specific user/profile fields
• Error response fields
• JSON parsing helper return values

Removed providers

The following clients were removed because their backing APIs are no longer available in their previous form:

• InstagramClient
• XingClient

TwitterClient renamed to XClient

TwitterClient has been replaced by XClient to reflect the provider rename from Twitter to X.

The old TwitterClient name remains as an obsolete compatibility wrapper.

Provider behavior changes

Several providers were updated to current endpoints, schemas, or authorization behavior.

Provider updates include:

• GitHub now uses Bearer authorization instead of the deprecated token authorization scheme.
• Google was updated to v2/v3 endpoints and now uses the sub field from the v3 schema.
• Facebook is pinned to Graph API v25.0.
• LinkedIn was updated to v2 OpenID Connect.
• Todoist was updated to REST API v1.
• VK API version was updated.
• Uber authentication endpoints were updated.
• X user info now includes email where available.
• Microsoft Identity Platform support was added through the new MicrosoftClient.

New features

Microsoft Identity Platform support

Added MicrosoftClient using Microsoft Identity Platform v2.0 and Microsoft Graph v1.0.

This is the preferred path for new Microsoft integrations.

MicrosoftClient is not intended to be a drop-in replacement for every WindowsLiveClient usage.

Configurable HTTP timeout

Added transport-level request options for configuring timeout behavior.

var options = new RequestOptions
{
    Timeout = TimeSpan.FromSeconds(30)
};

This resolves the long-standing need to configure HTTP request timeout behavior without changing OAuth identity configuration.

Improved OAuth error diagnostics

UnexpectedResponseException now captures OAuth callback error details when providers return error and error_description.

For example, when a user denies authorization, consumers can now inspect the actual OAuth error code such as access_denied and the provider-supplied description.

The exception message now includes these details for easier debugging.

Provider updates

This release includes a broad provider audit and modernization pass.

Added

• MicrosoftClient

Removed

• InstagramClient
• XingClient

Renamed

• TwitterClient -> XClient

Updated

• GitHubClient
• GoogleClient
• FacebookClient
• LinkedInClient
• TodoistClient
• UberClient
• VkClient
• XClient

Documented provider status

The README now includes a provider compatibility matrix with provider status, API version, authorization endpoint, and verification notes.

A new provider audit document captures active, legacy, deprecated, rebranded, and removed provider status.

Security and reliability improvements

• Upgraded several provider endpoints from HTTP to HTTPS.
• Added CodeQL workflow for C# security analysis.
• Improved null handling in provider user-info parsing.
• Fixed Asana parsing when users have no profile photo.
• Fixed Odnoklassniki request signing behavior.
• Added additional argument validation in request factory paths.
• Added more defensive JSON parsing.
• Improved OAuth callback error reporting.
• Added more provider serialization and parsing coverage.
• Added missing state and avatar test assertions.

JSON serialization changes

OAuth2 now uses System.Text.Json internally.

Changes include:

• Converted JSON-using providers from Newtonsoft.Json to JsonDocument / JsonElement.
• Converted token response parsing to System.Text.Json.
• Added helper methods for safer string extraction and case-insensitive property access.
• Added guards for null, missing, and unexpected JSON values.
• Added provider-specific serialization and parsing tests.
• Added coverage for numeric IDs, avatar URLs, boolean values, null values, and provider edge cases.

Build and dependency updates

• Converted solution to .slnx.
• Updated target frameworks:
  • Library: netstandard2.0, net8.0, net10.0
  • Tests: modern .NET test targets
• Upgraded RestSharp to 114.0.0.
• Removed Newtonsoft.Json.
• Upgraded MinVer.
• Upgraded NUnit.
• Upgraded NUnit3TestAdapter.
• Upgraded FluentAssertions.
• Upgraded Microsoft.NET.Test.Sdk.
• Upgraded NSubstitute.
• Upgraded AsyncFixer.
• Upgraded Microsoft.SourceLink.GitHub.
• Updated GitHub Actions:
  • actions/checkout
  • actions/setup-dotnet
• Added NuGet package README support.
• Fixed build warnings and warning-as-error issues.

Testing

This release includes a substantial test modernization pass.

Test improvements include:

• Provider-specific JSON serialization coverage.
• Provider parsing regression tests.
• Request factory timeout tests.
• Null handling tests.
• OAuth error response tests.
• Asana null photo regression test.
• Additional WindowsLive avatar and state assertions.
• Additional numeric ID conversion tests.
• Test naming and structure cleanup.

Migration guide

1. Update your package reference

<PackageReference Include="OAuth2" Version="1.0.0-beta1" />

2. Rebuild and review nullable warnings

If your project has nullable reference types enabled, review any new warnings from OAuth2 API usage.

Many provider fields are now correctly annotated as nullable because external OAuth provider data may be missing.

3. Replace removed providers

If you use InstagramClient or XingClient, those clients have been removed because the underlying APIs are no longer available in their previous form.

4. Prefer XClient over TwitterClient

Replace new usages of:

var client = new TwitterClient(...);

with:

var client = new XClient(...);

TwitterClient remains as an obsolete compatibility wrapper.

5. Review custom subclasses

If you subclass OAuth clients or override JSON parsing behavior, review those implementations carefully.

Parsing now uses System.Text.Json instead of Newtonsoft.Json.

6. Review custom request factory implementations

If you implement IRequestFactory, update your implementation for the new RequestOptions overload.

7. Validate RestSharp-specific integrations

If your application interacts directly with RestSharp types through OAuth2 extensibility points, validate behavior with RestSharp 114.0.0.

...

What's Changed

• Yandex avatars by @ETCDema in #143
• Allow OAuth2Client refresh token to be updated when grant_type is "refresh_token" by @jholzer-cciq in #151

New Contributors

• @ETCDema made their first contribution in #143
• @jholzer-cciq made their first contribution in #151

Full Changelog: v0.10.2...v0.10.3

What's Changed

• Update readme.md by @semack in #139
• Fix GitHub authenticator configuration by @ejsmith in #141
• Fix build by @ejsmith in #142

New Contributors

• @ejsmith made their first contribution in #141

Full Changelog: v0.10.1...v0.10.2