From d97638201ed2e213958b2ea11b5beab97e9c43fe Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 12:26:45 +0000 Subject: [PATCH] docs: include consent-time access_denied for inactive accounts Clarify that provider-side active-account enforcement can reject OAuth consent submission when account status changes during the authorization session. --- docs/INTEGRATION_GUIDE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index dbfa722..cf09c6c 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -139,6 +139,7 @@ try { Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion. WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid. Existing authenticated sessions may also be invalidated when account status changes to disabled. +OAuth authorization consent submission can return `access_denied` if the account becomes inactive between session establishment and consent completion. ## Operational guidance