Technical Advisory - Upcoming changes to Ory Hydra and OAuth2 on Ory Network

Upcoming updates to Ory Hydra and Ory OAuth2 APIs on Ory Network.
These changes will roll out no earlier than June 20, 2025.
Review the changes below and update your systems if needed.

1. Pagination token format changes

The format of pagination tokens (query parameter page_token) returned by the following endpoints is changing:

GET /admin/clients
GET /admin/oauth2/auth/sessions/consent
GET /admin/trust/grants/jwt-bearer/issuers

What to do — Do not inspect or modify pagination tokens manually. They are opaque and may change at any time. Instead, follow the guidance in our official pagination guide:

API REST Pagination Guide

2. Consent session response order change

The response from the following endpoint will no longer be ordered by request time. It will now return results in random order, based on the primary key ID. This improves performance and scalability of the endpoint.

GET /admin/oauth2/auth/sessions/consent

What to do — If your system depends on the order of results, update it. The API does not guarantee ordering.

3. Removal of X-Total-Count header

The following endpoints will no longer return the X-Total-Count response header:

GET /admin/clients
GET /admin/oauth2/auth/sessions/consent
GET /admin/trust/grants/jwt-bearer/issuers

What to do — If you rely on this header for pagination or analytics, update your implementation. We are removing this header to improve API performance at scale.

Action Required

• Review and test your integrations

• Stop manually crafting tokens

• Update logic that assumes ordered responses

• Remove reliance on X-Total-Count

If these changes affect your production systems and you cannot mitigate in time, create a ticket or reach out to us immediately. We are committed to helping you transition with minimal disruption.

If you have questions or concerns, contact us via Zendesk, Slack, or email to support@ory.sh.