November 2, 2025

v0.2.5: Enterprise Security & OAuth2

A major release transforming generated API clients into production-ready, enterprise-grade solutions with complete OAuth2, structured error handling, request validation, and interceptors.

Complete OAuth2 Flow Support

All standard OAuth2 flows: Authorization Code with PKCE (RFC 7636, SHA256), Client Credentials, Password, and Implicit. Includes cryptographically random code verifier generation, state parameter CSRF protection, token storage with expiration tracking, and automatic token refresh.

Enterprise Error Handling

Structured ApiError class with status codes, isClientError()/isServerError() helpers, and error body. RequiredError for missing fields with getErrorDetails() and getVerboseMessage().

Request/Response Validation

Built-in validation catches missing required fields and type errors before requests are sent. Configurable via validateRequests flag with detailed error messages.

Request/Response Interceptors

Full control over the request/response lifecycle. Request interceptors for adding headers and logging, response interceptors for data normalization, and error interceptors for global error handling (e.g., 401 redirect to login).

Multiple Authentication Methods

Bearer token (static or dynamic), API Key, Basic Auth, and OAuth2. OAuth2 takes priority when configured. Includes security warnings for client secrets in browser code and XSS vulnerability alerts for localStorage token storage.

Additional Features

Configurable request timeouts (default 30s, per-client or per-request), React Query integration examples, and comprehensive security documentation in generated READMEs.