From 7d0319332f67d0d0810d5411e8b4cb1101e6942d Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 11:39:50 +0000 Subject: [PATCH] docs: clarify callback access_denied causes include privilege changes Update integration guidance so consuming apps treat access_denied as an expected provider authorization result when membership or privilege state changes during the OAuth consent flow. --- docs/INTEGRATION_GUIDE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index 158276b..fd78674 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -66,7 +66,7 @@ if (isset($_GET['error'])) { $error = (string) $_GET['error']; $description = isset($_GET['error_description']) ? (string) $_GET['error_description'] : 'Unknown provider error'; // access_denied is a normal authorisation outcome (for example, membership - // revoked or user denied consent between request and submit). + // revoked, privilege changed, or user denied consent between request and submit). http_response_code($error === 'access_denied' ? 403 : 400); exit('Authorization failed: ' . $description); }