releases.shpreview
Auth0/Auth0 Changelog

Auth0 Changelog

$npx @buildinternet/releases show auth0-changelog
Mon
Wed
Fri
AprMayJunJulAugSepOctNovDecJanFebMarApr
Less
More
Releases510Avg156/moVersionsv202547 → v202614
Jul 31, 2025

Introducing a new capability for log streaming: PII Masking.

This feature allows customers to obfuscate (hash or mask) sensitive personal identifiable information (e.g., email address, phone number, username, etc.) within their log streams. This enhancement improves security and compliance for customers who stream their logs to data lakes or third-party tools.

Key Features:

  • Customizable PII Masking: Customers can select specific PII data to be masked in their log streams.
  • Enhanced Security and Compliance: This capability helps customers meet stricter compliance requirements by providing greater control over sensitive data in their logs.
  • Broad Applicability: PII masking will be available for both new and existing log streams.

This update aligns with Auth0's commitment to improving customer data security and providing more customization in log stream outputs

For more information - Log Streams

Introducing a new capability for log streaming: PII Masking.

This feature allows customers to obfuscate (hash or mask) sensitive personal identifiable information (e.g., email address, phone number, username, etc.) within their log streams. This enhancement improves security and compliance for customers who stream their logs to data lakes or third-party tools.

Key Features:

  • Customizable PII Masking: Customers can select specific PII data to be masked in their log streams.
  • Enhanced Security and Compliance: This capability helps customers meet stricter compliance requirements by providing greater control over sensitive data in their logs.
  • Broad Applicability: PII masking will be available for both new and existing log streams.

This update aligns with Auth0's commitment to improving customer data security and providing more customization in log stream outputs

For more information - Log Streams

Introducing a new capability for log streaming: PII Masking.

This feature allows customers to obfuscate (hash or mask) sensitive personal identifiable information (e.g., email address, phone number, username, etc.) within their log streams. This enhancement improves security and compliance for customers who stream their logs to data lakes or third-party tools.

Key Features:

  • Customizable PII Masking: Customers can select specific PII data to be masked in their log streams.
  • Enhanced Security and Compliance: This capability helps customers meet stricter compliance requirements by providing greater control over sensitive data in their logs.
  • Broad Applicability: PII masking will be available for both new and existing log streams.

This update aligns with Auth0's commitment to improving customer data security and providing more customization in log stream outputs

For more information - Log Streams

Jul 22, 2025

We’ve added support for Cascade Revocation in Native to Web SSO.

With this new capability, revoking the original refresh token used in a Native to Web flow will now automatically revoke all dependent web sessions and their issued refresh tokens.

This helps prevent stale or orphaned sessions and ensures that once the root token is no longer valid, all downstream access is properly revoked.


What’s new:

  • enable_cascade_revocation
    When enabled, revoking a native app’s refresh token also revokes all web sessions and refresh tokens created via session_transfer_token.

  • enable_online_refresh_tokens
    When enabled, refresh tokens issued during a Native to Web SSO flow are tied to the lifetime of their associated session (i.e., online tokens).


Default behavior:

Both of these settings are enabled by default, even when not explicitly configured.

This means:

  • All clients using Native to Web SSO today already benefit from cascade revocation.
  • Web-issued refresh tokens will automatically expire when their sessions expire.

You can manage or override these settings using the Auth0 Management API.


Why it matters:

This update provides stronger guarantees around token lifecycle and session integrity across platforms:

  • Prevents misuse of refresh tokens after logout or revocation
  • Reduces risk from long-lived sessions in embedded web views
  • Helps developers maintain a tighter, more secure cross-platform SSO experience

Learn more in our Native to Web SSO documentation

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

We’ve added support for Cascade Revocation in Native to Web SSO.

With this new capability, revoking the original refresh token used in a Native to Web flow will now automatically revoke all dependent web sessions and their issued refresh tokens.

This helps prevent stale or orphaned sessions and ensures that once the root token is no longer valid, all downstream access is properly revoked.


What’s new:

  • enable_cascade_revocation
    When enabled, revoking a native app’s refresh token also revokes all web sessions and refresh tokens created via session_transfer_token.

  • enable_online_refresh_tokens
    When enabled, refresh tokens issued during a Native to Web SSO flow are tied to the lifetime of their associated session (i.e., online tokens).


Default behavior:

Both of these settings are enabled by default, even when not explicitly configured.

This means:

  • All clients using Native to Web SSO today already benefit from cascade revocation.
  • Web-issued refresh tokens will automatically expire when their sessions expire.

You can manage or override these settings using the Auth0 Management API.


Why it matters:

This update provides stronger guarantees around token lifecycle and session integrity across platforms:

  • Prevents misuse of refresh tokens after logout or revocation
  • Reduces risk from long-lived sessions in embedded web views
  • Helps developers maintain a tighter, more secure cross-platform SSO experience

Learn more in our Native to Web SSO documentation

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

We’ve added support for Cascade Revocation in Native to Web SSO.

With this new capability, revoking the original refresh token used in a Native to Web flow will now automatically revoke all dependent web sessions and their issued refresh tokens.

This helps prevent stale or orphaned sessions and ensures that once the root token is no longer valid, all downstream access is properly revoked.


What’s new:

  • enable_cascade_revocation
    When enabled, revoking a native app’s refresh token also revokes all web sessions and refresh tokens created via session_transfer_token.

  • enable_online_refresh_tokens
    When enabled, refresh tokens issued during a Native to Web SSO flow are tied to the lifetime of their associated session (i.e., online tokens).


Default behavior:

Both of these settings are enabled by default, even when not explicitly configured.

This means:

  • All clients using Native to Web SSO today already benefit from cascade revocation.
  • Web-issued refresh tokens will automatically expire when their sessions expire.

You can manage or override these settings using the Auth0 Management API.


Why it matters:

This update provides stronger guarantees around token lifecycle and session integrity across platforms:

  • Prevents misuse of refresh tokens after logout or revocation
  • Reduces risk from long-lived sessions in embedded web views
  • Helps developers maintain a tighter, more secure cross-platform SSO experience

Learn more in our Native to Web SSO documentation

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

We’ve added support for Cascade Revocation in Native to Web SSO.

With this new capability, revoking the original refresh token used in a Native to Web flow will now automatically revoke all dependent web sessions and their issued refresh tokens.

This helps prevent stale or orphaned sessions and ensures that once the root token is no longer valid, all downstream access is properly revoked.


What’s new:

  • enable_cascade_revocation
    When enabled, revoking a native app’s refresh token also revokes all web sessions and refresh tokens created via session_transfer_token.

  • enable_online_refresh_tokens
    When enabled, refresh tokens issued during a Native to Web SSO flow are tied to the lifetime of their associated session (i.e., online tokens).


Default behavior:

Both of these settings are enabled by default, even when not explicitly configured.

This means:

  • All clients using Native to Web SSO today already benefit from cascade revocation.
  • Web-issued refresh tokens will automatically expire when their sessions expire.

You can manage or override these settings using the Auth0 Management API.


Why it matters:

This update provides stronger guarantees around token lifecycle and session integrity across platforms:

  • Prevents misuse of refresh tokens after logout or revocation
  • Reduces risk from long-lived sessions in embedded web views
  • Helps developers maintain a tighter, more secure cross-platform SSO experience

Learn more in our Native to Web SSO documentation

We’ve added support for Cascade Revocation in Native to Web SSO.

With this new capability, revoking the original refresh token used in a Native to Web flow will now automatically revoke all dependent web sessions and their issued refresh tokens.

This helps prevent stale or orphaned sessions and ensures that once the root token is no longer valid, all downstream access is properly revoked.


What’s new:

  • enable_cascade_revocation
    When enabled, revoking a native app’s refresh token also revokes all web sessions and refresh tokens created via session_transfer_token.

  • enable_online_refresh_tokens
    When enabled, refresh tokens issued during a Native to Web SSO flow are tied to the lifetime of their associated session (i.e., online tokens).


Default behavior:

Both of these settings are enabled by default, even when not explicitly configured.

This means:

  • All clients using Native to Web SSO today already benefit from cascade revocation.
  • Web-issued refresh tokens will automatically expire when their sessions expire.

You can manage or override these settings using the Auth0 Management API.


Why it matters:

This update provides stronger guarantees around token lifecycle and session integrity across platforms:

  • Prevents misuse of refresh tokens after logout or revocation
  • Reduces risk from long-lived sessions in embedded web views
  • Helps developers maintain a tighter, more secure cross-platform SSO experience

Learn more in our Native to Web SSO documentation

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

We’ve added support for Cascade Revocation in Native to Web SSO.

With this new capability, revoking the original refresh token used in a Native to Web flow will now automatically revoke all dependent web sessions and their issued refresh tokens.

This helps prevent stale or orphaned sessions and ensures that once the root token is no longer valid, all downstream access is properly revoked.


What’s new:

  • enable_cascade_revocation
    When enabled, revoking a native app’s refresh token also revokes all web sessions and refresh tokens created via session_transfer_token.

  • enable_online_refresh_tokens
    When enabled, refresh tokens issued during a Native to Web SSO flow are tied to the lifetime of their associated session (i.e., online tokens).


Default behavior:

Both of these settings are enabled by default, even when not explicitly configured.

This means:

  • All clients using Native to Web SSO today already benefit from cascade revocation.
  • Web-issued refresh tokens will automatically expire when their sessions expire.

You can manage or override these settings using the Auth0 Management API.


Why it matters:

This update provides stronger guarantees around token lifecycle and session integrity across platforms:

  • Prevents misuse of refresh tokens after logout or revocation
  • Reduces risk from long-lived sessions in embedded web views
  • Helps developers maintain a tighter, more secure cross-platform SSO experience

Learn more in our Native to Web SSO documentation

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

We’ve added support for Cascade Revocation in Native to Web SSO.

With this new capability, revoking the original refresh token used in a Native to Web flow will now automatically revoke all dependent web sessions and their issued refresh tokens.

This helps prevent stale or orphaned sessions and ensures that once the root token is no longer valid, all downstream access is properly revoked.


What’s new:

  • enable_cascade_revocation
    When enabled, revoking a native app’s refresh token also revokes all web sessions and refresh tokens created via session_transfer_token.

  • enable_online_refresh_tokens
    When enabled, refresh tokens issued during a Native to Web SSO flow are tied to the lifetime of their associated session (i.e., online tokens).


Default behavior:

Both of these settings are enabled by default, even when not explicitly configured.

This means:

  • All clients using Native to Web SSO today already benefit from cascade revocation.
  • Web-issued refresh tokens will automatically expire when their sessions expire.

You can manage or override these settings using the Auth0 Management API.


Why it matters:

This update provides stronger guarantees around token lifecycle and session integrity across platforms:

  • Prevents misuse of refresh tokens after logout or revocation
  • Reduces risk from long-lived sessions in embedded web views
  • Helps developers maintain a tighter, more secure cross-platform SSO experience

Learn more in our Native to Web SSO documentation

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

We’ve added support for Cascade Revocation in Native to Web SSO.

With this new capability, revoking the original refresh token used in a Native to Web flow will now automatically revoke all dependent web sessions and their issued refresh tokens.

This helps prevent stale or orphaned sessions and ensures that once the root token is no longer valid, all downstream access is properly revoked.


What’s new:

  • enable_cascade_revocation
    When enabled, revoking a native app’s refresh token also revokes all web sessions and refresh tokens created via session_transfer_token.

  • enable_online_refresh_tokens
    When enabled, refresh tokens issued during a Native to Web SSO flow are tied to the lifetime of their associated session (i.e., online tokens).


Default behavior:

Both of these settings are enabled by default, even when not explicitly configured.

This means:

  • All clients using Native to Web SSO today already benefit from cascade revocation.
  • Web-issued refresh tokens will automatically expire when their sessions expire.

You can manage or override these settings using the Auth0 Management API.


Why it matters:

This update provides stronger guarantees around token lifecycle and session integrity across platforms:

  • Prevents misuse of refresh tokens after logout or revocation
  • Reduces risk from long-lived sessions in embedded web views
  • Helps developers maintain a tighter, more secure cross-platform SSO experience

Learn more in our Native to Web SSO documentation

Auth0 is delighted to introduce Mexico as the latest AWS region for Private Cloud deployments.

This new region establishes our first Private Cloud presence in Mexico, directly addressing the needs of one of Latin America's largest and most dynamic digital economies. The addition of the Mexico region provides lower latency for customers throughout the country and helps meet local data residency and compliance requirements.

We remain committed to expanding our global footprint to serve our customers wherever they are in the world.

Latest
Apr 23, 2026
Tracking Since
Sep 25, 2024
Last checked Apr 24, 2026