You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
GatewayArea: what it touches
ImprovementsKind: in v2.1.228,
ImprovementsSection of the release
What
On the self-hosted gateway, POST /oauth/device_authorization and POST /oauth/token now answer with a plain 404 not found when the OIDC identity-provider config is absent, before any rate-limiting or form parsing. Previously the handlers ran regardless.
Details
This matches the discovery document, which already omitted both endpoints unless OIDC config was present.
The guard reads a config precondition; the exact config key it checks is not fully pinned down in the build.
Evidence
/oauth/device_authorization
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
