Auth0

Shipped Custom Token Exchange as GA, plus Flexible Password Policy GA and a wave of Early Access identity features.

Delegated sessions went GA. Custom Token Exchange is now generally available for Enterprise, B2B Professional, and B2C Professional tenants. It exchanges an existing Auth0 or external IdP token for Auth0 tokens using custom Action logic, and underpins Session Delegation, which lets an authorized actor like a support agent open a web session as another user while preserving both sub and act claims.

Password policy reached GA. Flexible Password Policy replaces legacy password configuration with a single password_options object supporting composition rules, history checks, dictionary blocking (10k/100k-word lists plus custom entries), and profile-data blocking. Configured in the Dashboard or Management API.

Connections, sync, and hardening. Custom Prompts now capture the same signup/login fields and consent checkboxes on Social and Enterprise connections as on database/passwordless. Google Workspace Directory Sync for Groups hit GA with a paginated, searchable dashboard UI and self-service selective group sync. Custom Rate Limits (EA) lets you cap per-client Authentication API RPS with block or notify enforcement. Organizations Search gained advanced filtering by name, ID, metadata, third-party client access, and app entitlement status, with filters combinable via AND/OR logic and shareable via URL.