Diff

--- a/mod_http_oauth2/README.md	Fri Apr 11 23:19:21 2025 +0700
+++ b/mod_http_oauth2/README.md	Tue Apr 29 23:27:06 2025 +0700
@@ -86,6 +86,15 @@
 oauth2_security_policy = "default-src 'self'" -- this is the default
 ```
 
+For the Resource Owner Password Grant the `username` is expected to be the only
+localpart by default.  If the OAuth client includes the domainpart in the
+`username` it submits (e.g. user@example.org instead of just user), set this to
+`true`. Note that this requires all clients to follow this format.
+
+```lua
+oauth2_expect_username_jid = false
+```
+
 ### Token parameters
 
 The following options configure the lifetime of tokens issued by the module.