sources/oauth: introduce authorization code auth method, for 2025.2

[rissson]

Details

#14034 but for 2025.2

---

Checklist

• Local tests pass (ak test authentik/)
• The code has been formatted (make lint-fix)

If an API change has been made

• The API schema has been updated (make gen-build)

If changes to the frontend have been made

• The code has been formatted (make web)

If applicable

• The documentation has been updated
• The documentation has been formatted (make website)
  Co-authored-by: Rsgm [email protected]
  Signed-off-by: Marc 'risson' Schmitt [email protected]

[netlify]

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	f1034ef
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/67f95aa7e2e3db0008dc8905

[codecov]

Codecov Report

Attention: Patch coverage is 90.00000% with 4 lines in your changes missing coverage. Please review.

Project coverage is 92.69%. Comparing base (8e84fe6) to head (f1034ef).

✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
authentik/sources/oauth/clients/oauth2.py	71.42%	4 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                 @@
##           version-2025.2   #14035      +/-   ##
==================================================
- Coverage           92.73%   92.69%   -0.05%     
==================================================
  Files                 793      793              
  Lines               40362    40371       +9     
==================================================
- Hits                37429    37420       -9     
- Misses               2933     2951      +18     

Flag	Coverage Δ
e2e	48.00% <90.00%> (-0.02%)	⬇️
integration	24.30% <75.00%> (+<0.01%)	⬆️
unit	90.45% <75.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-f1034ef04e0dae53c2d800ded1e0d513ddd04c9f
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-f1034ef04e0dae53c2d800ded1e0d513ddd04c9f

Afterwards, run the upgrade commands from the latest release notes.