Skip to main content

What's new in 2025

These highlights are archived. They describe features and changes announced during 2025 and are kept for reference. For current updates, see What's new.

December 2025​

Return authentication script errors to your application​

Post-authentication extension script errors now return to the OAuth 2.0 client callback URL as query parameters instead of showing a server-side error page. Your application can read the error and handle custom authentication failures gracefully.

Security and reliability improvements​

  • Login discovery endpoint performance improved by replacing repeated cache lookups with a single query.

November 2025​

Track granted authorization details in audit events​

Audit events now include the granted authorization details for Rich Authorization Requests (RAR), which improves debugging and compliance tracking for fine-grained authorization.

Security and reliability improvements​

  • Fixed a device fingerprint (DBFP) timeout that was not cleared after a successful load, which could cause unexpected redirects with a dbfp=failure query parameter.
  • Refined the button layout on the Create identity provider view.

October 2025​

reCAPTCHA v3 on registration and password reset​

Registration and password reset forms now use reCAPTCHA v3, with automatic fallback to reCAPTCHA v2 when the score falls below the configured threshold (0.5 by default). This reduces friction for legitimate users while keeping bot protection.

Brute-force counter in authentication audit events​

Authentication audit events now include the identity brute-force counter for failed attempts, so you can monitor and respond to credential attacks.

System APIs for scripts and client management​

New system-level APIs let you manage authorization server scripts with full create, read, update, delete, and list operations, and delete OAuth 2.0 clients programmatically. Dedicated scopes control access to each.

Security and reliability improvements​

  • Fixed an AWS authorizer error caused by a stale configuration file handle.

September 2025​

SAML IdP-initiated SSO is now generally available​

Launch applications directly from your identity provider without a service-provider-initiated flow. SAML assertion issued audit events now include idp_initiated and service_provider_id fields for clearer audit trails.

Enhanced authentication dashboard​

The authentication dashboard now shows activity across all identity provider types and supports filtering by identity provider, giving you a single view of authentication traffic.

Geographical login distribution​

A new analytics view maps authentication activity by city and country, with top countries and cities, to help you spot unusual access patterns and potential threats.

Application topology view redesign​

Manage identity sources, client applications, services, and OAuth scope subscriptions in a unified visual interface with an improved layout and navigation.

Identity provider debugging and observability​

A new debug mode captures identity provider access tokens, ID token payloads, and sanitized SAML responses in Accept IdP audit events. Login accepted events now include an idp_mapping field to help you troubleshoot attribute mappings.

Security and reliability improvements​

  • FAPI 2.0 workspaces now enforce PAR parameter isolation, ignoring authorize-endpoint parameters when PAR is used, for specification compliance.
  • Fixed identity pool default attribute mappings so the first_name and last_name claims are included in ID tokens and user info.
  • Fixed a missing kid claim in CDR data recipient notification JWT headers.

August 2025​

Social and enterprise identity providers are now generally available​

Connect users through seven built-in social providers, Apple, Facebook, GitHub, Google, LinkedIn, Microsoft, and X, that work out of the box, plus new enterprise providers including Google Workspace, Okta V2, and a generic OAuth 2.0 provider. The common identity providers feature flag has been removed.

Risk Insights dashboard​

A new dashboard tracks security threats with dedicated leaked-credentials detection, restricted-country monitoring, and a comprehensive risk events table.

SAML service provider discovery​

Automatically route authentication requests to the correct service provider based on domain or entity ID.

Client pre-login policies​

Enforce security requirements and device posture checks before authentication begins, strengthening your Zero Trust posture.

Bulk credential reset​

Force a credential reset for all users in an identity pool from the UI for rapid response to a suspected compromise.

Rotate and revoke server secrets in the UI​

Rotate and revoke server secrets directly in the admin UI, without API calls.

Security and reliability improvements​

  • Added a system API to list workspaces programmatically.
  • Fixed incorrect rejection of mTLS token endpoint requests that use a DPoP JWT with the htu claim set to that endpoint.
  • Fixed the Hub export workspace API when exporting a regular workspace with the manage_regular_workspaces scope.

July 2025​

User groups are now generally available​

Group management is now available to all tenants and the Groups feature flag has been removed. You can also include user group memberships as claims in tokens and assertions, choosing direct membership, effective membership including parent groups, or a specific list.

Redesigned user management​

A redesigned user view offers streamlined navigation for managing user attributes, roles, and group assignments. New default attribute schemas for Profile, Business, and Delegated attributes are now shared across admin and regular workspaces.

Simplified workspace creation​

The Create workspace wizard now focuses on choosing a workspace type and entering basic details, and it automatically creates an identity pool for every new workspace.

SAML response binding configuration​

Configure how SAML responses are bound and transmitted, using strict_compliance, compatibility_mode, or force_post, to balance security and interoperability with your service providers.

Security and reliability improvements​

  • Refresh token flows now consistently issue only the originally granted scopes.
  • Audit events now include a granted_scopes field.
  • Fixed the CIBA grant type being repeatedly appended to the grant types list on every update.
  • Fixed the User portal app URL and redirect URIs when importing a server with the initialize flag set.

June 2025​

User Activity Analytics dashboard​

New charts show LOA score over time, authentication breakdown, and MFA friction, alongside active-user counts and top accounts by risk, password resets, and authentication failures, so you can tune security against user experience.

Tenant-level identity pools​

Create identity pools at the tenant level for centralized user management across multiple workspaces. This is disabled by default for new tenants.

Redesigned pool schema editor​

A more intuitive schema editor streamlines editing custom user attributes and improves visualization for easier configuration management.

Responsive self-service portal​

The self-service user portal now adapts to mobile, tablet, and desktop screens. OTP and TOTP inputs use a numeric keyboard on mobile devices for easier entry.

MFA recovery for Rich Authorization Requests​

The built-in consent page now supports MFA recovery for RAR policies, and introspection responses include the granted authorization details.

Security and reliability improvements​

  • Authentication analytics now include operating system and browser distribution graphs, and audit events capture browser and OS metadata.
  • Server pre-login policies now run for both OAuth/OIDC and SAML flows.
  • CDR workspaces block ID token encryption for dynamic client registration and retire the hybrid flow, allowing only the authorization code flow.
  • Deactivate an organization or a workspace.
  • Filter audit events by result.
  • Save changes with Ctrl/Cmd+S in configuration editors.

May 2025​

Orchestrated identity provider discovery​

Attach pre- and post-interaction scripts to the discovery flow to dynamically guide users to the right identity provider based on context, domain, or custom logic.

Enforce a single audience in authentication JWTs​

A new advanced server configuration enforces a single audience check in assertion JWTs for the private_key_jwt and client_secret_basic authentication methods, mitigating audience injection. It is enabled by default for new workspaces, except CDR.

Security and reliability improvements​

  • Added APIs to rotate and revoke server secrets.
  • Optimized the list organizations API and added a with_child_count parameter.
  • The default SAML Name ID is now the user's email.
  • SMS OTP setup now indicates that Twilio configuration is required.

April 2025​

Import SAML service provider metadata manually​

A new API lets you import SAML service provider metadata manually, for providers that do not publish a metadata URL.

SAML scoping as an identity provider hint​

Added support for SAML scoping, which you can use as an identity provider hint during authentication.

Custom token subject from the authentication context​

Use an authentication context attribute as the subject of the access token or ID token, giving you control over the sub claim.

Security and reliability improvements​

  • A new version of the /password/verify API returns HTTP 200 on an incorrect password and provides detailed verification results.
  • Added support for Redis 7.

March 2025​

Expanded SAML identity provider configuration​

New options let you configure the SAML Name ID and its format, redirect SSO binding, custom attribute filtering, a per-service-provider signing hash algorithm, organization metadata, and automatic service provider metadata refresh. You can also discover users by SAML subject Name ID.

Custom error reporting in scripts​

Return a custom message and status code from a policy or script to fail with a specific error. Supported codes are 400, 401, 403, and 429.

Disable self-service credential reset per identity pool​

Turn off user self-reset credential flows during authentication, configurable in identity pool settings.

Security and reliability improvements​

  • New system APIs manage and rotate client secrets.
  • Filter clients by type in the List Clients API using the client_types query parameter.
  • Added support for salted MD5 for existing, imported passwords in identity pools.
  • Added the country code and city to audit event metadata.

February 2025​

Authentication analytics​

New authentication analytics report authentication activity, including breakdowns by location and device type, laying the foundation for the dashboards released later in the year.

Just-in-time pre-provisioning mode​

Just-in-time provisioning adds a pre mode, which requires the user to already exist in the identity pool rather than provisioning automatically. A configurable fallback denies access or authenticates through the identity provider when the user does not exist.

Security and reliability improvements​

  • Renamed Cloudentity Administrators to Tenant Administrators.
  • Managers can grant the manager role, and user managers can grant the user_manager role.
  • Added next signing and encryption keys to the /.well-known/jwks.json endpoint.
  • max_age=0 in the authorize flow now forces reauthentication, similar to prompt=login.
  • Added a circuit breaker to the SMTP client for improved reliability.

January 2025​

PKCE support for the OIDC identity provider​

The generic OIDC identity provider adds a None (PKCE) authentication method and a Use PKCE option for the client secret and private key JWT methods.

Granular system scopes and license management​

New manage_system_workspace, manage_admin_workspace, and manage_regular_workspaces scopes give you finer control over hub workspace management APIs as an alternative to manage_configuration. Root APIs can now manage tenant licenses.

Security and reliability improvements​

  • Exposed the Verify Authentication Code (System) API, and Inspect OTP now returns the code type.
  • The client create and import API accepts multiple certificates in the certificate field, separated by new lines.
  • Initialize admin and system workspaces through the import configuration API.
  • Dynamic Client Registration no longer fails the entire request when a scope policy fails; it excludes the affected scopes or authorization details instead.
  • Added a mobile and desktop preview switch to the theme editor.
  • Fixed a timezone mismatch in SAML assertions.