Skip to main content

What's new

Learn about the latest major additions to the SecureAuth SaaS platform. This page collects the current year's highlights, newest first. At the end of each year, that year's entries move to the What's new archive.

July 2026​

Dark mode is now available​

The administrator and organization portals now support dark mode, a lower-contrast appearance option for low-light environments. Click the moon or light icon in the portal top bar to switch between light and dark mode.

Return custom metadata from code and OTP verification endpoints​

You can now attach custom metadata when you create a code and retrieve it when the code is consumed, so you can carry context through a verification without a separate lookup. The verifyAuthenticationCode, verifyOTP, and inspectOTP endpoints return the metadata you set at creation, for all code types.

Security and reliability improvements​

  • Workspace role grants are now confined to the user's home workspace tree, which prevents assigning a role on an organization in a different top-level workspace.
  • Open Banking UK and Brazil consent access is now scoped to the owning client, closing a cross-client access gap.
  • Identity self-service forms, including sign-up, password reset, and MFA, now return a validation error on invalid input instead of an internal error.
  • Custom claims sourced from organization metadata now persist across token refresh and single sign-on.
  • Identity export and workspace clone no longer omit identity pools in tenants that have more pools than the listing limit.

June 2026​

Map the identity provider as a token claim or SAML attribute​

You can now map the identity provider method and ID used during login as a claim in OpenID Connect tokens and as an attribute in SAML assertions. Select the Login session source and choose IDP Method or IDP ID. See Manage token claims.

Export users with credentials for migration​

A new system API, GET /configuration/pools/{ipID}/users, exports a pool's users, including their credentials, as an importable configuration dump. This lets you migrate users between pools without requiring them to reset their credentials.

Require user interaction before passkey prompt​

Identity pools now offer a Require user interaction before passkey prompt option. When enabled, the hosted login page no longer opens the browser passkey prompt automatically on page load; it appears after the user clicks Continue. See Passkeys.

Redesigned application quickstart​

The in-product application quickstart has a redesigned view that makes it easier to pick an integration scenario and follow a runnable sample. See Integrate your application using quickstart.

May 2026​

Internationalization is now generally available​

Multi-language support is now generally available for all tenants. You can deliver login, registration, consent, self-service, email, and SMS experiences in your customer's preferred language, with a default language for untranslated strings, an optional language selector, and custom translations. See Internationalization.

Smart passkeys are now generally available​

Smart passkeys, which let users sign in with a single tap and no username using discoverable credentials, are now generally available. Select Smart or Classic passkey mode for a workspace in Authentication > Settings > Methods. See Passkeys.

Application quickstart for all supported app types​

The application quickstart tab is now available for every application type that supports it, and includes mobile scenarios such as React Native and iOS. See Integrate your application using quickstart.

Require user confirmation before sending an OTP​

Identity pools now expose a Require user confirmation before sending OTP setting. When enabled, the hosted login flow no longer sends OTPs automatically; the user confirms first, which reduces unnecessary messages.

Subscribe to the user.deleted webhook at the workspace and organization level​

The user.deleted audit event is now available for webhook subscription at the workspace and organization levels, in addition to the admin and system levels. See Set up webhooks.

April 2026​

Inbound SCIM v2.0 provisioning is now generally available​

Inbound SCIM v2.0 provisioning is now generally available for all tenants. External identity providers such as Okta and Microsoft Entra ID can automatically provision and manage users in your identity pools, and the SCIM custom application type is available on the Custom Applications page. See Configure inbound SCIM provisioning.

RADIUS push and symbol-to-accept MFA (Early Access)​

RADIUS authentication now supports push notification and symbol-to-accept as MFA methods. The RADIUS server can poll for out-of-band results when users respond on their mobile devices. Available in Early Access. See Configure SecureAuth Connect on RADIUS.

Bring your own SMS and voice provider​

You can now connect your own Vonage or TeleSign account to deliver OTP by SMS and voice, alongside the existing Twilio support. In Tenant Settings > Message Providers > Phone Providers, set a primary provider and optional fallbacks to route OTP traffic through your own carrier contract. See SMS OTP and Voice OTP.

Control SMS message retention at the provider level​

You can now control whether SMS providers retain or discard message content and recipient phone numbers after delivery, using separate settings for message content and recipient number.

Merge DCR default scopes with requested scopes​

Dynamic Client Registration now always merges default scopes with the scopes a client requests, instead of applying defaults only when the client requests none.

Security and reliability improvements​

  • Sort client applications by date created or date updated, with both columns now sortable in the admin portal.
  • Public OAuth 2.0 clients no longer receive an unnecessary client secret during Dynamic Client Registration.
  • Multiple critical and high-severity dependency vulnerabilities were remediated across the platform.

March 2026​

Configure passkey settings in the admin UI​

The identity pool configuration page now includes a Passkey Settings section where administrators can configure the Relying Party ID and Relying Party Origins. See Passkeys.

Smart Passkey​

Usernameless Passkey is now called Smart Passkey across the admin UI, login screens, and user portal, with an updated icon. See Passkeys.

Per-pool user limits​

Identity pools now support configurable per-pool limits (default 20, range 1 to 100) on the number of identifiers, addresses, credentials, and codes a single user can have, which prevents unbounded growth.

Security and reliability improvements​

  • Workspace secrets are now masked in policy and script output, including audit events, debug logs, and test endpoint responses.
  • User portal accessibility improvements bring color contrast and ARIA roles in line with WCAG 2 AA.
  • Several dependency security vulnerabilities were remediated, including a hotfix for a gRPC authorization bypass and an XML signature bypass.

February 2026​

Organizations is now generally available​

Organizations is now generally available and the beta feature flag has been removed. Organization management, delegated administration, and per-organization user populations are available to all tenants. See Organizations overview.

Internationalization (Early Access)​

Multi-language support is available in Early Access for all user-facing authentication and identity pages, including login, consent, MFA, registration, and password reset. Set a default locale, enable a language selector, and author custom translations. See Internationalization.

Optional second-factor skip when none is configured​

During activation or self-registration, users can now choose not to configure a second factor when none is set up. Once any 2FA method is configured, it is enforced. See Set up sign in and sign up methods.

Rate limiting on OTP send endpoints​

OTP-sending endpoints now enforce rate limiting to help prevent brute-force attempts on OTP codes.

Audit log date-range filtering​

Audit Logs now list events by date range, defaulting to the last 24 hours, with presets for the last 30 minutes, hour, week, and month. Live mode has been removed. See Audit Logs.

Client-credentials authorization for the standalone authorizer​

The standalone authorizer's management APIs (GET /apis, PUT /apis) now support OAuth 2.0 client-credentials authorization, with separate read and write scopes.

January 2026​

Paginated List IDPs API (v2)​

A new List IDPs v2 endpoint adds pagination and method filtering. Pass the methods query parameter with comma-separated values (for example, ?methods=static,oidc,azure) to filter identity providers by type. The previous List IDPs endpoint is now deprecated.

Two-step activation​

User activation now uses a two-step flow so that email security scanners cannot trigger activation by following the link. The user confirms on a landing page before the account is activated.

OIDC response_type=none support​

The authorization server now supports the OIDC response_type=none response type.

Previous years​

For updates announced before this year, see the archive: