Authorizer Files

Enterprise SSO (SAML IdP, verified domains, home realm discovery), WebAuthn/passkey login, SCIM 2.0, machine and agent identity (client_credentials, RFC 7523 workload identity, RFC 8693 delegation), a remote MCP server, gRPC and REST alongside GraphQL, and an OpenFGA-backed authorization engine.

Breaking: --url is now required, the at-rest encryption key is split out as --encryption-key, MFA is on by default and opt-out, and /userinfo filters claims by scope. Read [CHANGELOG.md](https://github.com/authorizerdev/authorizer/blob/main/CHANGELOG.md#240 before upgrading — every breaking entry states what to change.

New: --redirect-uris holds this deployment's own client to an exact redirect_uri match, the rule OIDC Core §3.1.2.1 states and the one clients registered through RFC 7591 or a metadata document already got. Unset keeps the --allowed-origins fallback, which compares origins and so accepts any path under an allowed host.

Verified for this release: make test-all-db across all seven backends, make lint, make smoke, the Playwright e2e suite (105 tests), the SDK-driven Go e2e suite, and a Trivy scan with no HIGH/CRITICAL findings.

OpenID Foundation conformance: the Config profile passes clean. On the Basic profile 17 modules pass and 9 raise warnings. The two modules that require an unregistered redirect_uri to be refused — oidcc-ensure-registered-redirect-uri and oidcc-ensure-request-object-with-redirect-uri — now run to the suite's manual review step with no failed assertions when --redirect-uris is set.