Security

An MCP server can give an agent a one-time link that opens a browser already signed in as the user.

Custom session claims can now use session.created_at and session.expire_at shortcodes to read a session's age and expiry from its token, and a new Backend API PATCH endpoint sets a single session's expire_at between 5 minutes and 10 years out. Changes are recorded as session.expiry.updated events in Admin and Application Logs.

Application Logs in the Dashboard now show each sign-in or sign-up as one row with its event count and final completed or failed status, expandable to the individual events in order. GET /v1/logs returns grouped logs by default; pass view=flat to get one item per event.

GET /v1/logs now returns email events, filterable by type and recipient email, and the Dashboard's Application Logs page shows them alongside other event types. Email Logs filters now match exactly instead of by substring, blocked sends appear as Bounced or Failed, and Message ID shows the Clerk email ID when available.