Mastodon 4.4 removes OAuth password grant and HTTP Basic auth, adds deprecation headers

What changed

Mastodon 4.4.0 was released on July 8, 2025. Per its changelog it removes the OAuth Password Grant Type and HTTP Basic Authentication, forbids account creation via user tokens, and adds Deprecation headers on deprecated API endpoints. It also adds a userinfo OAuth endpoint, DELETE /api/v1/media/:id, and registrations.min_age on the Instance entity.

What it means

Apps that sign in with the OAuth password grant or HTTP Basic authentication stop working on servers running 4.4 or later.

Who is affected

Developers of Mastodon clients and schedulers that log in with a username and password, and users on servers upgrading to 4.4.

What to do by 8 Jul 2025

Switch to the standard OAuth authorization code flow. Servers run by different admins upgrade at different times, so expect a mixed fleet.