What runs today
Scheduled means not built yet. It is on this list so you can see what you would be waiting for.
| Capability | Status |
|---|---|
| Authorization code + PKCE (S256) | Live |
| Refresh tokens, single-use rotation | Live |
| Token introspection (RFC 7662) | Live |
| Token revocation (RFC 7009) | Live |
| Login and consent screen | Live |
| SSO and federation | Scheduled |
| Per-organization signing keys | Scheduled |
| Device authorization flow (RFC 8628) | Scheduled |
| Token exchange (RFC 8693) | Scheduled |
| Bring your own cloud (BYOC) | Scheduled |
| Client authentication: JWT assertions (RFC 7523) and mTLS (RFC 8705) | Scheduled |
| Pushed authorization requests (RFC 9126) | Scheduled |
| JWT-secured authorization requests (RFC 9101) | Scheduled |