{"version":"2.1.228","anchor":"gateway-oauth-endpoints-return-404-when-sign-in-is-not-confi","canonical_anchor":"gateway-oauth-endpoints-return-404-when-sign-in-is-not-confi","heading":"Gateway OAuth endpoints return 404 when sign-in is not configured","tier":"notice","area":"Gateway","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228\/e\/gateway-oauth-endpoints-return-404-when-sign-in-is-not-confi","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228","markdown":"### Gateway OAuth endpoints return 404 when sign-in is not configured\n\nGateway sign-in endpoints return a flat 404 when no identity provider is configured.\n\n**What**\n\nOn the self-hosted gateway, `POST \/oauth\/device_authorization` and `POST \/oauth\/token` now answer with a plain 404 `not found` when the OIDC identity-provider config is absent, before any rate-limiting or form parsing. Previously the handlers ran regardless.\n\n**Details**\n\n- This matches the discovery document, which already omitted both endpoints unless OIDC config was present.\n- The guard reads a config precondition; the exact config key it checks is not fully pinned down in the build.\n\n**Evidence**\n\n`\/oauth\/device_authorization`\n\n- Area: Gateway\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}