Build Independently confirmed 2 publishers 2 min read Published Sep 18, 2026, 6:07 AM PDT

Ktor 3.6.0 turns the auth provider into a value the route can type-check

The typed authentication module and Netty's HTTP/3 support both arrive experimental in Ktor 3.6.0, while the changes that touch code you already wrote are two deprecations and one client Accept-header setting.

The Engineer · Build desk

Send a correction

What happened

JetBrains released Ktor 3.6.0 with typed authentication, specialized OpenID Connect support and HTTP/3 for the Netty engine, all of it described in the announcement as experimental.
The typed authentication module also covers role-based access checks and anonymous users, alongside the type safety it adds for complex authentication setups.
Netty's HTTP/3 runs over QUIC, and its opt-in block tunes flow-control limits, UDP socket configuration and an idle timeout that JetBrains sets to 30 seconds in the sample.
The same engine can now serve cleartext h2c on one connector and HTTP/2 over TLS on another, switched on with enableH2c = true and enableHttp2 = true.

Why it matters

Who has to decide decision The experimental label sets the scope of a sensible test: one service on a branch, with no promise the API arrives unchanged in the next minor release.
What it costs cost HTTP/3 costs more than a dependency bump. Because QUIC travels over UDP, whoever runs the load balancers and firewalls has to open the same port for UDP before the listener is reachable.
What it limits constraint A team that adopts none of the experimental features still has edits to schedule, because two functions their code may call today are now deprecated.
What's now possible capability A service that currently hand-rolls token refresh and login redirects can test a library path for it, with sessions and a browser login interface included.

Next story · Build · Oct 7

JetBrains now recommends Kotlin Toolchain 0.13 for most new multiplatform projects

One report1 publisher

`authenticateWith(jwtAuth)` takes the provider, not its name. In the sample JetBrains published, `jwt<User>("my-jwt")` is assigned to a val, and the route block references that val, so the principal type travels with it: the sample reads `val user = call.principal`, with no type argument and no cast ^[12]. JetBrains describes the older arrangement as implicit typing bridging configuration to routes, and the new module as types that guarantee full type safety when working with complex authentication ^[2].

The elegant part of that syntax depends on Kotlin context parameters, according to the release post ^[4]. So the Kotlin version in your build constrains this upgrade as much as the Ktor version does.

The OpenID Connect plugin follows the same shape. `install(Oidc)` returns a value, `identityProvider("auth0")` declares an issuer and a `bearer` block with an audience set, and the route authenticates against `auth0.jwtBearer` before reading `call.principal.claims.subject` ^[5]. Providers are typed, and JetBrains says the plugin supports all OpenID Connect features in a typed way ^[5].

`enableHttp3 { }` does not stand alone. The documented order is an SSL connector first, then the opt-in block ^[7]; in the sample that connector listens on port 8443 ^[11]. QUIC is carried over UDP, which is why the block exposes UDP socket configuration at all ^[8], and it means 8443 has to be open for UDP on every hop in front of the service, not just TCP. JetBrains did not publish latency or throughput figures for the HTTP/3 path, so there is no vendor number here to test against your own traffic. Feedback is explicitly requested ^[9], which is the polite way of saying the API can still move.

The two deprecations are ordinary maintenance. `ApplicationCall.receive()` now accepts nullable types, and `receiveNullable()` is deprecated in consequence ^[15]. `respondHtmlPartial` replaces the deprecated `respondHtmlFragment` and uses `TagConsumer<Appendable>`, so it can emit partial HTML with every element `FlowContent` supports ^[16]. Parameter conversion also covers Kotlin's `Uuid`, `Byte` and the unsigned numeric types, which makes `val id: Uuid by call.parameters` work in a route ^[14].

On the client side, ContentNegotiation used to merge its registered content types into every `Accept` header ^[17]. With `ContentTypeMergeStrategy.SkipIfPresent`, an explicit `Accept` header wins, and requests without one still get the registered types added ^[17]. Anyone carrying an interceptor to undo that merge for one strict API can drop it. The cheap way to test the rest is a throwaway project from the generator at start.ktor.io with one protected route ^[10].

What to watch

Whether the typed authentication module and Oidc plugin keep their current API shape in 3.7 or churn before the experimental label comes off.
Whether JetBrains publishes measurements, or a production-support statement, for the Netty QUIC path.
Whether receiveNullable() and respondHtmlFragment get removal versions in a following release.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption15
Hype gap+34
Incentives70
Confidence60

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
JetBrains announced Ktor 3.6.0 as available, describing the release as full of new experimental features including typed authentication capabilities with specialized support for OpenID Connect and HTTP/3 support for the Netty engine, plus quality-of-life improvements for routing and request handling and more convenient defaults for Kotlin Multiplatform clients.
Reported SupportedView cited source
[2]
According to the release post, Ktor's authentication had until now relied on implicit typing to bridge configuration to the routes; the new module provides types to guarantee full type safety when working with complex authentication.
Reported SupportedView cited source
[3]
The typed authentication module also supports role-based access and anonymous users.
Reported SupportedView cited source
[4]
JetBrains wrote that by leveraging context parameters, the team was able to ensure even more elegant syntax in the typed authentication module.
Reported SupportedView cited source
[5]
The new OpenID Connect (Oidc) plugin allows creation of typed authentication providers that support all OpenID Connect features in a typed way; the sample uses val oidc = install(Oidc), oidc.identityProvider("auth0") { issuer = "https://my-tenant.auth0.com"; bearer { audience = setOf("https://api.example.com") } }, then authenticateWith(auth0.jwtBearer) and call.principal.claims.subject.
Reported SupportedView cited source
[6]
The Oidc plugin includes support for sessions and a browser login interface with auto-refreshing tokens.
Reported SupportedView cited source
[7]
The Netty server engine now has experimental HTTP/3 support over QUIC; to enable it you configure an SSL connector, then opt in with enableHttp3 { }.
Reported SupportedView cited source
[8]
The enableHttp3 block sets QUIC-specific settings such as flow-control limits and UDP socket configuration; the sample sets quicMaxIdleTimeout = 30.seconds.
Reported SupportedView cited source
[9]
JetBrains states the HTTP/3 support is still experimental and asks for feedback from anyone who tries it.
Reported SupportedView cited source
[10]
JetBrains points readers to the interactive project generator at start.ktor.io to start a project on Ktor 3.6.0.
Reported SupportedView cited source
[11]
In the HTTP/3 sample, the sslConnector is configured with a keyStore, keyAlias "server", a keyStorePassword lambda returning "changeit", and port = 8443.
Reported SupportedView cited source
[12]
The published sample assigns a provider to a value, val jwtAuth = jwt<User>("my-jwt") { verifier(jwkProvider, issuer) validate { ... } }, and the route block uses authenticateWith(jwtAuth) { get("/profile") { val user = call.principal ... } }.
Reported SupportedView cited source
[13]
A Netty server can now serve h2c on one connector and HTTP/2 over TLS on another, enabled with enableH2c = true and enableHttp2 = true.
Reported SupportedView cited source
[14]
Request-parameter conversion now supports Kotlin's Uuid, Byte and unsigned numeric types, as in the sample's val id: Uuid by call.parameters.
Reported SupportedView cited source
[15]
ApplicationCall.receive() now also accepts nullable types, making the route contract explicit and deprecating receiveNullable().
Reported SupportedView cited source
[16]
The release adds respondHtmlPartial, which replaces the deprecated respondHtmlFragment and uses TagConsumer<Appendable>, so it can respond with unrestricted partial HTML including all elements supported by FlowContent.
Reported SupportedView cited source
[17]
The client ContentNegotiation plugin used to merge its registered content types into every Accept header; with ContentTypeMergeStrategy.SkipIfPresent an explicit Accept header wins, and when a request has no Accept header the plugin continues to add the registered content types.
Reported SupportedView cited source
[18]
The Ktor 3.6.0 announcement names two deprecated functions that existing code may call: receiveNullable() and respondHtmlFragment.
Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

blog.jetbrains.com
1 article · September 18, 2026
Ktor 3.6.0 Is Now Available!
dev.to
1 article · September 18, 2026
JetBrains Releases Ktor 3.6.0 with HTTP/3 & OpenID Connect Support

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

Everything a Kotlin backend developer can act on today comes from JetBrains' own release post, and most of it is small: request parameters convert Uuid, Byte and unsigned types, receive() takes nullable types, and respondHtmlPartial takes over from respondHtmlFragment. The two headline items ship experimental. Typed authentication turns a provider into a value — val jwtAuth = jwt<User>("my-jwt") { ... } — that authenticateWith then type-checks at the route, and the Oidc plugin does the same for identity providers. If your client code sets its own Accept header, ContentTypeMergeStrategy.SkipIfPresent is the line worth reading twice.

Operator

HTTP/3 does not switch itself on. It needs an sslConnector and an explicit enableHttp3 { } block, which is also where QUIC idle timeout, flow-control limits and UDP socket settings live; the sample sets quicMaxIdleTimeout = 30.seconds on port 8443. Netty can serve h2c on one connector and HTTP/2 over TLS on another. JetBrains calls the QUIC support experimental and asks for feedback, and it did not publish latency or throughput figures; dev.to's line about lower latency on unreliable networks rests on nothing measured.

Investor

No pricing, licence or customer figure appears anywhere in this reporting. The investor-facing material is dev.to's framing: Kotlin as a contender against Node.js, Go and Rust, enterprises extending one language stack from Android to the backend, a 4.0 release in early 2027, and a partnership with 'the Claude AI ecosystem'. None of it is in JetBrains' release post, which is the only primary record here.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence62: 0100
Vendor post with its code printed, nothing independent
Every API detail here traces to JetBrains' release post: the typed authentication types, the Oidc plugin, the enableHttp3 block, the parameter conversions, both deprecations. The post prints the code it describes, which is checkable by anyone who installs 3.6.0. The second account, dev.to, adds a maintainer quote, a trailing-slash routing change and a 2027 roadmap that the release post does not contain, so it corroborates none of the technical claims.
Adoption15: 0100
Artifact published, adoption unverified
The release is real and installable: 3.6.0 appears as a dependency coordinate in JetBrains' own Gradle snippet, and start.ktor.io generates projects on it. Past that, our coverage has little to point to: there is no reported deployment, no download count, and dev.to's 'early adopters on GitHub' are unnamed and unlinked.
Hype gap+34: −100 understated0 aligned+100 overstated
Experimental features written up as finished ones
JetBrains applies the word experimental to both typed authentication and HTTP/3 and asks for feedback on the QUIC work. dev.to calls the same release a leap forward that positions Kotlin against Node.js, Go and Rust, reports latency gains nobody measured, and drops the experimental label entirely. That overstatement is dev.to's addition; the release post makes no such claims.
Incentives70: 0100
Product blog announcing its own product
The primary record is JetBrains' marketing channel for a framework it maintains and a language it sells tooling for, and the post closes by steering readers to its project generator. The samples themselves still run as written and can be checked. The secondary piece ends with its own keyword list: 'tech news, open source project milestone or release, startup, AI, innovation'.
Confidence60: 0100
Firm on the API surface, thin beyond it
Which functions changed and what they now accept can be read off the release post and tested in an afternoon, and the deprecations are unambiguous. The questions that would drive a planning decision — how rough the QUIC path is in practice, when the experimental APIs stabilise, whether anyone is running them — are answered by neither account.

Topics and entities

Topics

Web framework releases
HTTP/3 and QUIC adoption
API deprecations
Type-safe authentication