EventHandlerAPIPlugin now requires an app-issued bearer token on every request — the bare caller-supplied client_token (a UUID naming a session) is no longer accepted. This closes the session-takeover vector where a caller could name (or guess) another session's token: sessions are now server-generated and bound to a bearer the app issues, obtained from the anonymous token endpoint or the OAuth flow. State reads redact the session's server-side client_token/session_id from the returned router var so the session token never reaches the client. (#198)
EventHandlerAPIPlugin no longer exposes auth/framework event handlers (any OIDCAuthState provider, the page guard, route dispatchers, AuthUserState, and other reflex/reflex_enterprise states). Callers drive the app's own handlers and authenticate through the token endpoint or the OAuth flow rather than by queueing the login events directly. (#198)
OIDC cookie names now carry a _partitioned suffix so they do not collide with the unpartitioned cookies written by earlier versions. Sessions established before this upgrade are not recognized under the new names, so users sign in once more after it is deployed. (#206)

Features

New: reflex_enterprise.MCPPlugin — serve a Reflex app to AI agents over the Model Context Protocol. Adding the plugin mounts an MCP server that publishes the app's public event handlers as search_events / queue_event tools, a reflex:// resource family for reading the app (reflex://state, reflex://event[/{event_name}], reflex://state/events/{state_name}, and reflex://state/vars/{state_name}[/{var_name}] for the caller's live session state, computed vars recomputed), and auto-generated instructions covering the app's location, auth model, tool workflow and pages, so a client knows how to drive it on connect. configure= (a callable or a "module.function" path) hands you the underlying FastMCP server before it is mounted to register your own tools, resources and prompts — also reachable at runtime via reflex_enterprise.get_mcp_server(); expose_events=False publishes reads only, without the app's action surface; pending_updates= chooses "drop" (default) or "queue" (buffered for a get_pending_updates tool) for deltas from chained events and background tasks, which have no websocket to land on. Upload handlers cannot run inline, so queue_event returns out-of-band upload directions (URL, headers, form fields and a curl example) carrying a short-lived, single-use ticket bound to the one handler it was minted for. Requires the optional mcp extra (pip install reflex-enterprise[mcp]). (#198)
MCP OAuth: with an AuthPlugin configured, MCPPlugin makes the app a spec-compliant OAuth 2.1 Authorization Server + Resource Server for its MCP endpoint, federating the human login to the existing OIDC flow through a brandable consent page. Clients discover the flow (RFC 9728 / RFC 8414), register dynamically (RFC 7591), and receive the app's own opaque, resource-bound tokens — upstream identity-provider tokens never leave the server. Each token is bound to a dedicated session, so the full enforcement stack (per-event gate, callable auth= checks, delta filtering, AuthUserState.current()) applies to agent traffic unchanged. app_scopes={name: description} renders each scope as an individually grantable checkbox on the consent screen and the minted token carries only what was granted, readable in auth= callbacks via ctx.token_scopes. Tokens and consent live in Redis when the app is configured for it, otherwise in-process. On by default alongside an AuthPlugin; opt out with MCPPlugin(auth=False). In production the issuer must be served over https — a plain-http issuer (outside loopback dev hosts) is rejected at wiring time with a ConfigError, since the authorization server hands out bearer credentials on that origin. See the production/TLS section in docs/mcp.md. (#198)
The rxe.mcp.resource decorator tags a state method as a top-level MCP resource — a var-like, parameterized, read-only view of the caller's session state, served at state-resource://<state>/<method>[/{param}] with the method's parameters as URI-template variables. It is never an event handler, so it stays out of search_events / queue_event, and its auth= (True/False/a check(ctx) callable, the same contract as rxe.var) gates the read whenever an AuthPlugin provides identity. (#198)
Anonymous API sessions: MCPPlugin and EventHandlerAPIPlugin serve POST /_reflex/auth/token, returning an app-issued bearer bound to a fresh, server-generated session — the client never picks or sees the underlying client token. The endpoint is rate limited per client IP (token_rate_limit) so one origin cannot mint unbounded sessions. With an AuthPlugin an agent may stay anonymous (no user identity, so only auth=False surfaces are reachable) or complete the OAuth flow for an authenticated session. On by default; turn it off with anonymous_sessions=False on every API plugin you register, since the shared endpoint is served if either enables it. (#198)
Auth contexts (event/var/page) now carry ctx.surface ("browser" / "event_api" / "mcp") and ctx.token_scopes (the app-issued token's scopes, or None for a browser request), so auth= checks can restrict what a delegated agent may do independent of the underlying user's identity. (#198)
Per-token API rate limiting: every MCP/REST call is counted against the presenting session token (call_rate_limit / call_rate_window), with per-handler overrides via rxe.event(rate_limit=..., rate_limit_window=...) (rate_limit=0 exempts a handler). (#198)
Cross-origin iframe login: OIDC cookies are now set with SameSite=None and the Partitioned attribute (including on Python versions whose http.cookies cannot emit Partitioned itself), so an app can complete the login flow while embedded in an iframe whose outer page is on a different origin. Logging out from the inner frame now clears the session proactively instead of waiting for a postMessage from the popup -- that message was only ever caught by a listener bound to the login button, so it never arrived on a page that rendered no login button. (#206)
An app that does not configure the AuthPlugin no longer loads the auth system from its OIDC providers. The provider helpers that reach for plugin-owned things -- AuthUserState, the deauthentication app-state sweep, the audit emissions -- are wrapped in @requires_plugin(AuthPlugin) and do nothing when the plugin is absent, so the provider still clears its own cookies but never grafts AuthUserState onto a state tree the frontend compiled without it. Previously that state was loaded anyway and every update computed for it reached the client as a dispatch error on the frontend and backend consoles.
The guard is reusable by any plugin integration that must stay inert in apps that did not enable the plugin: reflex_enterprise.plugins.guards exposes requires_plugin(SomePlugin, default=...) as a decorator for sync and async helpers, plus has_plugin / configured_plugin for the underlying question. (#210)

Bug Fixes

Popup auth flows honor redirect_to_url again: it is saved before the flow is initiated, so the query parameter set on the iframed page survives, and the saved URL is what the success handler redirects to. (#206)
Fix a cross-site iframe losing a valid session to a cross-tab logout that never happened. An iframe's partitioned localStorage cannot see the token hash the login popup wrote at top level, so its empty report was read as proof that another tab had logged out -- and won that race whenever it arrived before the server-queued hash write. The reported hash is now a change ping rather than a verdict: any disagreement queues one cookie sync and the callback adopts whatever the cookie jar holds. Token material means record the session's hash, re-assert it into this partition's localStorage and refresh if due; an empty jar is a real logout and resets as before. (#207)
MessageListener no longer accumulates message listeners. Its effect cleanup removed a different function than the one it registered, so a listener leaked on every re-render and each popup message was then handled once per leaked listener. (#208)

v0.9.3 (2026-08-05)

Features

Auth: AuthPlugin(audit=...) — an observe-only audit hook called for every auth lifecycle action (login, logout, token refresh, session expiry) and every access decision (event gate, page guard). See the audit docs. (#200)
Auth: replay gate-blocked events after login — an action blocked by the event gate for an anonymous visitor (the click or form submit that triggered the login redirect) is preserved and replayed once the user authenticates and lands back on the same page, instead of being silently lost (#190)

Bug Fixes

OIDC: split authorization-callback failure outcomes — handle identity-provider error responses, restart the flow once when the sign-in session was lost, and reserve the "possible CSRF attack" warning for a genuine state mismatch; the callback is now also idempotent across websocket reconnects instead of re-firing against an already-exchanged code (#203)
OIDC: stop reporting expired ID tokens as backend errors — routine expiry during re-validation now logs at INFO without a traceback and no longer sets has_error; signature and other validation failures still log at ERROR (#202)

Miscellaneous

OIDC: add token-presence context (access_token/id_token/refresh_token booleans, never values) to forced-logout warnings so the cause is visible in production logs (#195)
OIDC: attribute forced logouts from the token-refresh paths in logs and downgrade the userinfo reset warning to debug for anonymous visitors, cutting log noise (#203)
Fix unawaited-coroutine RuntimeWarnings in the auth test suite (#192)

v0.9.2.post1 (2026-07-06)

Bug Fixes

Do not update AuthUserState when AuthPlugin is not registered (#196)
Serialize HTTPCookie.sync requests to avoid data race (#196)

v0.9.2 (2026-07-06)

Features

Add Highcharts chart component (#182)
Add reflex_app pytest plugin for downstream testability (#179)

Bug Fixes

Auth: redeliver protected vars on public pages (#186)

Performance

Auth: skip protected-var redelivery on same-user navigation (#187)

Miscellaneous

Add logging to silent auth failure/logout paths (#188)

v0.9.1 (2026-07-01)

Features

Add reflex_enterprise.AuthPlugin providing integrated secure-by-default auth primitives for protecting pages, fields, vars, and event handlers. See the full docs for usage.