django-allauth 65.19.0 released

Posted by Raymond Penners on 2026-08-06

Noteworthy changes

Officially support Django 6.1.
IdP: Added support for Client ID Metadata Document (CIMD).
IdP: Added IDP_OIDC_REFRESH_TOKEN_EXPIRES_IN, allowing refresh tokens to expire. Combined with IDP_OIDC_ROTATE_REFRESH_TOKEN, this results in a sliding (inactivity) window. Defaults to None (no expiry), preserving the previous behavior. Whenever a refresh token carries an expiry, its remaining lifetime is returned to the client as refresh_expires_in in the token response.
IdP: Added an oidc_cleartokens management command that deletes expired OpenID Connect tokens.
IdP: Added key rotation support via IDP_OIDC_PRIVATE_KEYS, as well as cache control for the JWKS endpoint.
IdP: Added RFC 7662 OAuth 2.0 Token Introspection support.
The jwt and cryptography dependencies are now imported lazily. Deployments that register JWT-verifying providers (e.g. Google, or OpenID Connect) - for example, no longer pay their memory cost (roughly 8-10 MiB per process) unless a token is actually verified.
On the "Change Password" form, the "Forgot password?" link has been moved into the password field help text, and the "Reauthenticate" form now shows it too. As on the login form, the link can be customized via the account/password_reset_help_text.html template.

IdP: App native URLs wouldn't be accepted as post_logout_redirect_uri.
IdP: Fix IDP_OIDC_ID_TOKEN_EXPIRES_IN always returning the default value, even if set in settings.