feat(ir): add OAuthAuthorizationCode.redirectUriBackupPorts for loopback port fallback (#17281)

Co-authored-by: rishabh.dhadda <rishabh.dhadda@postman.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: devin-ai-integration[bot]

packages/cli/cli/changes/unreleased/ir-oauth-redirect-backup-ports.yml

@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=../../../../../fern-changes-yml.schema.json
+
+- summary: |
+    Add the additive `OAuthAuthorizationCode.redirectUriBackupPorts` IR field (fallback loopback
+    callback ports for the authorization-code/PKCE flow). No behavior change for existing configs.
+  type: internal

packages/cli/generation/ir-generator-tests/src/dynamic-snippets/__test__/oauthPublicClientDynamic.test.ts

@@ -48,6 +48,7 @@ describe("dynamic snippets for public-client OAuth flows", () => {
                 tokenUrl: "https://auth.example.com/token",
                 refreshUrl: undefined,
                 redirectUri: undefined,
+                redirectUriBackupPorts: undefined,
                 scopes: undefined,
                 pkce: { method: FernIr.auth.OAuthPkceMethod.S256 },
                 authorizationParameters: undefined,

packages/cli/register/src/ir-to-fdr-converter/__test__/convertAuth.test.ts

@@ -25,6 +25,7 @@ const AUTHORIZATION_CODE_CONFIG = Ir.auth.OAuthConfiguration.authorizationCode({
     tokenUrl: "https://auth.example.com/token",
     refreshUrl: undefined,
     redirectUri: undefined,
+    redirectUriBackupPorts: undefined,
     scopes: undefined,
     pkce: { method: Ir.auth.OAuthPkceMethod.S256 },
     authorizationParameters: undefined,

packages/ir-sdk/fern/apis/ir-types-latest/VERSION

@@ -1 +1 @@
-67.17.0
+67.18.0

packages/ir-sdk/fern/apis/ir-types-latest/changelog/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v67.18.0] - 2026-07-29
+
+- Add `OAuthAuthorizationCode.redirectUriBackupPorts` (`optional<list<integer>>`): additional
+  loopback callback ports for the authorization-code (PKCE) flow, tried in order when the
+  `redirectUri` port is unavailable. Each reuses `redirectUri`'s host and path (only the port
+  differs) and must be pre-registered with the authorization server. Lets a generated CLI bind a
+  fixed-port fallback set (e.g. 8484 → 8483 → 8482) for identity providers that bind each client to
+  specific callback ports. Ignored when `redirectUri` is unset.
+
 ## [v67.17.0] - 2026-07-28
 
 - Add `OAuthConfiguration.authorizationCode` (`OAuthAuthorizationCode`), an additive union variant

packages/ir-sdk/fern/apis/ir-types-latest/definition/auth.yml

@@ -135,6 +135,18 @@ types:
           When omitted, the CLI uses a loopback redirect on an ephemeral (OS-assigned) port with
           the path `/callback` (i.e. http://127.0.0.1:<random-port>/callback), per RFC 8252 §7.3.
           This requires the authorization server to allow arbitrary loopback ports for the client.
+
+          Backup ports for when this port is busy can be listed in `redirectUriBackupPorts`.
+      redirectUriBackupPorts:
+        type: optional<list<integer>>
+        docs: |
+          Additional loopback ports for the authorization-code (PKCE) callback, tried in order when
+          the port in `redirectUri` is already in use. Each backup reuses the same host and path as
+          `redirectUri` (i.e. only the port differs), and every resulting callback URI must be
+          pre-registered with the authorization server. Ignored when `redirectUri` is unset (an
+          ephemeral port is used instead). Enables a fixed-port fallback set (e.g. redirectUri on
+          8484 with backups [8483, 8482]) for identity providers that bind each client to specific
+          callback ports.
       scopes:
         type: optional<list<string>>
         docs: The scopes requested during authorization.