Recent security improvements to provisional account OIDC issuer validation are now documented. Existing integrations are unaffected, but review the new requirements before editing your configuration.
We've made security improvements to how Discord validates OIDC issuer URLs and fetches OIDC configuration for provisional accounts — including stricter hostname checks and blocking HTTP redirects during configuration and JWKS discovery.
Existing provisional account OIDC integrations are not affected and will continue to work without any changes on your part.
However, if you need to edit your OIDC configuration in the Developer Portal, your updated configuration will be validated against these requirements. We've published new documentation covering the full set of OIDC Integration Requirements — including issuer URL rules, discovery document requirements, supported signing algorithms, and ID token claims. Before making any changes to a production integration, review those requirements and verify your configuration works in a test application first.