{"collection":{"slug":"auth-identity","name":"Auth & Identity"},"digest":{"id":"cwd_uhlAdTRHfuCqPvuv8pG_1","weekStart":"2026-06-01","title":"The week M2M went multi-tenant and SCIM closed the loop","intro":"Auth0 shipped machine-to-machine access for third-party applications and made Inbound SCIM Groups generally available, while Clerk rolled out prebuilt organization management UI across its native mobile SDKs and a major backend API update.","body":"### M2M access for third-party apps and SCIM group mapping at scale\n\nAuth0 took two significant steps forward in API-first, multi-tenant identity this week. [Strict third-party applications](/release/rel_InkNqbTYHBlikNQPh3q3I-auth0-m2m-support-for-third-party-applications-is-now-generally-available) now support the `client_credentials` grant type for machine-to-machine access, including the ability to scope M2M tokens to specific organizations. For teams exposing APIs to AI agents or partner backends that operate without a user in the session, this closes a gap that required workarounds. M2M access is restricted to apps created via the Management API or Dashboard — DCR-registered apps are excluded, maintaining the secure-by-default posture Auth0 introduced with third-party apps.\n\nAlongside that, the [GA release of Inbound SCIM Groups](/release/rel_CZMXeo7_6H1VymBjrajlF-auth0-inbound-scim-groups-for-enterprise-connections-now-generally-available) for Enterprise Connections lets you map synced groups directly to Auth0 roles at the tenant level or scoped per organization. When combined with Auto-Membership, users in synced groups inherit permissions at login without custom provisioning logic. WorkOS also shipped a complementary piece: [SCIM bearer token rotation](/release/rel_dDGXAx036yG9HkcKs1Vwn-workos-adds-scim-bearer-token-rotation) for directory integrations, now available from the Admin Portal and Directory Sync dashboard.\n\nAuth0's [Dashboard Search for Applications](/release/rel_4dbVxa-bxuvp-9Ao7K59G-auth0-dashboard-search-for-applications-now-in-public-beta) entered public beta, supporting real-time filtering by name, client ID, metadata, application type, and more (up to five combinable filters that persist via URL). The broader [Dashboard navigation refresh](/release/rel_mjyglJVjlnJLNoVYHt5qe-auth0-dashboard-navigation-and-information-architecture-refresh-now-in-beta) is also in beta, reorganizing pages around common tasks with flattened navigation. Existing bookmarks redirect automatically, and all underlying APIs are unchanged.\n\n### Clerk fills in the organization-graph gaps\n\nAfter weeks of shipping steady improvements across its SDK matrix, Clerk's most consequential release for team-product developers this week came on the native side: the [Clerk iOS (1.2.0)](/release/rel_3CeEd_zlrviK9v7x_vvkK-clerk-ios-sdk-1-2-0-supports-swift-6-2-and-adds-session-reverification) and Android SDKs (via the [June 5 changelog](/release/rel_91Wxq8c92GCqkIRl9SL0y-clerk-ios-and-android-sdks-add-prebuilt-organization-management-ui)) now include prebuilt Organization management UI. The components cover the full spectrum — `OrganizationSwitcher` for account switching, `OrganizationListView` for standalone selection, and `OrganizationProfileView` with permission-gated management of members, domains, and org lifecycle actions. The iOS SDK also adds session reverification convenience APIs and bumps to Swift 6.2 and Xcode 26.\n\nOn the backend, [`@clerk/backend` v3.5.0](/release/rel_K5TDSvVfZHi7h7DbXcqCU-clerk-javascript-sdk-clerk-backend-3-5-0-adds-user-email-and-phone-replacement) introduces long-requested user email and phone replacement APIs: `users.replaceUserEmailAddress` and `users.replaceUserPhoneNumber` let you overwrite all addresses with a single verified, primary value in one call. The same release fixes an issue where `authenticateRequest` was consuming the request body, preventing downstream handlers from reading it, and preserves custom claims during JWT-format M2M token verification. Framework SDKs for [Next.js](/release/rel_LlugBB3sviUlYr5OE5LYK-clerk-nextjs-v7-4-3-prevents-keyless-mode-in-ci-environments), [Nuxt](/release/rel_cDMmfBU5WpwiDW9apjRI7-clerk-javascript-sdk-clerk-nuxt-2-5-3-prevents-keyless-mode-in-ci), [Astro](/release/rel_QakV9q_H4tSXSxuH88-ao-clerk-astro-3-3-3-prevents-keyless-mode-in-ci-environments), [TanStack React Start](/release/rel_T__rdmJVVHg7BTyT4IxYa-clerk-javascript-sdk-clerk-tanstack-react-start-1-3-3-prevents-keyless-mode-in), and [React Router](/release/rel_19JGWZa2XOFkcgePijiQq-clerk-react-router-3-3-3-prevents-keyless-mode-in-ci-environments) coordinated to prevent keyless mode from activating in CI and other automated environments.\n\n### Better Auth and Supabase round out the week\n\n[Better Auth v1.6.14](/release/rel_gPRTotnXo9UlzAN8yBC6Y-better-auth-v1-6-14-fixes-google-one-tap-account-mismatch-and-session-cookie) landed several high-severity fixes: Google One Tap no longer authenticates against the wrong user when the presented account is already linked to a different local user, `getSessionCookie` now prefers the `__Secure-` cookie over a non-secure leftover, and SAML Single Logout no longer leaves users signed in on the server. Supabase Auth continued its release-candidate cycle for v2.190.0 with three new RCs (rc.19, rc.22, rc.23), though the stable changelog remained quiet. Clerk also pushed a large batch of dependency updates across its JavaScript SDK, including [captcha-by-OAuth-provider fix](/release/rel_3AeGHBS7-J4hxtWFhgHY4-clerk-javascript-sdk-v5-125-13-fixes-oauth-users-hanging-on-sso-callback) that resolves a long-tail bug where new OAuth users would hang on the SSO callback.","releaseIds":["rel_InkNqbTYHBlikNQPh3q3I","rel_CZMXeo7_6H1VymBjrajlF","rel_dDGXAx036yG9HkcKs1Vwn","rel_4dbVxa-bxuvp-9Ao7K59G","rel_mjyglJVjlnJLNoVYHt5qe","rel_3CeEd_zlrviK9v7x_vvkK","rel_91Wxq8c92GCqkIRl9SL0y","rel_K5TDSvVfZHi7h7DbXcqCU","rel_LlugBB3sviUlYr5OE5LYK","rel_cDMmfBU5WpwiDW9apjRI7","rel_QakV9q_H4tSXSxuH88-ao","rel_T__rdmJVVHg7BTyT4IxYa","rel_19JGWZa2XOFkcgePijiQq","rel_gPRTotnXo9UlzAN8yBC6Y","rel_3AeGHBS7-J4hxtWFhgHY4"],"releaseCount":41,"generatedAt":"2026-07-11T17:04:58.668Z","releases":[{"id":"rel_InkNqbTYHBlikNQPh3q3I","title":"Auth0 M2M Support for Third-Party Applications is now Generally Available","path":"/release/rel_InkNqbTYHBlikNQPh3q3I-strict-third-party-apps-now-support-m2m-with-client-credentials","org":{"slug":"auth0","name":"Auth0"},"importance":null},{"id":"rel_CZMXeo7_6H1VymBjrajlF","title":"Auth0 Inbound SCIM Groups for Enterprise Connections now generally available","path":"/release/rel_CZMXeo7_6H1VymBjrajlF-scim-groups-map-to-auth0-roles-self-service-provisioning-added","org":{"slug":"auth0","name":"Auth0"},"importance":null},{"id":"rel_dDGXAx036yG9HkcKs1Vwn","title":"WorkOS adds SCIM bearer token rotation","path":"/release/rel_dDGXAx036yG9HkcKs1Vwn-scim-bearer-tokens-now-rotatable","org":{"slug":"workos","name":"WorkOS"},"importance":null},{"id":"rel_4dbVxa-bxuvp-9Ao7K59G","title":"Auth0 Dashboard Search for Applications now in public beta","path":"/release/rel_4dbVxa-bxuvp-9Ao7K59G-dashboard-application-search-launches-in-beta","org":{"slug":"auth0","name":"Auth0"},"importance":null},{"id":"rel_mjyglJVjlnJLNoVYHt5qe","title":"Auth0 Dashboard navigation and information architecture refresh now in beta","path":"/release/rel_mjyglJVjlnJLNoVYHt5qe-dashboard-navigation-redesigned-flattened-sidebar-and-reorganized-pages","org":{"slug":"auth0","name":"Auth0"},"importance":null},{"id":"rel_3CeEd_zlrviK9v7x_vvkK","title":"Clerk iOS SDK 1.2.0 supports Swift 6.2 and adds session reverification","path":"/release/rel_3CeEd_zlrviK9v7x_vvkK-swift-6-2-support-session-reverification-conveniences-added","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_91Wxq8c92GCqkIRl9SL0y","title":"Clerk iOS and Android SDKs add prebuilt Organization management UI","path":"/release/rel_91Wxq8c92GCqkIRl9SL0y-prebuilt-organization-ui-comes-to-ios-android","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_K5TDSvVfZHi7h7DbXcqCU","title":"Clerk JavaScript SDK @clerk/backend@3.5.0 adds user email and phone replacement APIs","path":"/release/rel_K5TDSvVfZHi7h7DbXcqCU-user-email-phone-replacement-endpoints-added-request-body-consumption-fixed","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_LlugBB3sviUlYr5OE5LYK","title":"@clerk/nextjs v7.4.3 prevents keyless mode in CI environments","path":"/release/rel_LlugBB3sviUlYr5OE5LYK-keyless-mode-disabled-in-ci-and-automated-environments","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_cDMmfBU5WpwiDW9apjRI7","title":"Clerk JavaScript SDK @clerk/nuxt@2.5.3 prevents keyless mode in CI","path":"/release/rel_cDMmfBU5WpwiDW9apjRI7-keyless-mode-disabled-in-ci-and-automated-environments","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_QakV9q_H4tSXSxuH88-ao","title":"@clerk/astro@3.3.3 prevents keyless mode in CI environments","path":"/release/rel_QakV9q_H4tSXSxuH88-ao-keyless-mode-disabled-in-ci-and-automated-environments","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_T__rdmJVVHg7BTyT4IxYa","title":"Clerk JavaScript SDK @clerk/tanstack-react-start@1.3.3 prevents keyless mode in CI","path":"/release/rel_T__rdmJVVHg7BTyT4IxYa-keyless-mode-blocked-in-ci-environments","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_19JGWZa2XOFkcgePijiQq","title":"@clerk/react-router@3.3.3 prevents keyless mode in CI environments","path":"/release/rel_19JGWZa2XOFkcgePijiQq-keyless-mode-blocked-in-ci-development-warning-now-suppressible-via-env-var-in","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_gPRTotnXo9UlzAN8yBC6Y","title":"better-auth v1.6.14 fixes Google One Tap account mismatch and session cookie shadowing","path":"/release/rel_gPRTotnXo9UlzAN8yBC6Y-google-one-tap-no-longer-authenticates-wrong-user-stale-session-cookies-fixed","org":{"slug":"better-auth","name":"Better Auth"},"importance":null},{"id":"rel_3AeGHBS7-J4hxtWFhgHY4","title":"Clerk JavaScript SDK v5.125.13 fixes OAuth users hanging on SSO callback","path":"/release/rel_3AeGHBS7-J4hxtWFhgHY4-oauth-sign-in-to-sign-up-flow-no-longer-hangs-on-captcha","org":{"slug":"clerk","name":"Clerk"},"importance":null}]}}