fix(oauth): the consent screen never showed where the tokens go #5590
1 changed file+11−0
Modified.env.example+11−0View fileUnifiedSplit
@@ -114,6 +114,17 @@ AI_DAILY_BUDGET_CENTS=
114114# the code reads but nobody documents is exactly what the drift rule exists to
115115# catch. Setting it by hand will be overwritten on the next journey tick.
116116SIGNUP_INVITE_CODE=
117# Opens OAuth dynamic client registration (POST /oauth/register).
118#
119# Registration is CLOSED by default: the platform is in build-out, and an
120# external report showed the endpoint answering 201 to anyone with an
121# arbitrary redirect_uri. The operator toggle is the `oauth_dcr_enabled`
122# system flag in /admin, which needs no deploy; this env var exists so the
123# RFC 7591 validation suite can exercise the rules without a database.
124# Either being "true" opens it. Closing it does NOT affect clients that have
125# already registered — authorize, token and refresh never consult it — so
126# existing connectors keep working and only NEW self-registrations are refused.
127OAUTH_DCR_ENABLED=
117128# Container memory ceiling (docker-compose.standalone.yml). Default 2g.
118129# INCIDENT 2026-08-27: the container ran unbounded and leaked, taking a
119130# shared host to 96% full via five 10-13 GB core dumps. Raise on a
120131
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts