--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-06-01 title: The week M2M went multi-tenant and SCIM closed the loop release_count: 41 generated: 2026-07-11 canonical: https://releases.sh/collections/auth-identity/digest/2026-06-01 --- # The week M2M went multi-tenant and SCIM closed the loop Auth0 shipped machine-to-machine access for third-party applications and made Inbound SCIM Groups generally available, while Clerk rolled out prebuilt organization management UI across its native mobile SDKs and a major backend API update. ### M2M access for third-party apps and SCIM group mapping at scale Auth0 took two significant steps forward in API-first, multi-tenant identity this week. [Strict third-party applications](/release/rel_InkNqbTYHBlikNQPh3q3I-auth0-m2m-support-for-third-party-applications-is-now-generally-available) now support the `client_credentials` grant type for machine-to-machine access, including the ability to scope M2M tokens to specific organizations. For teams exposing APIs to AI agents or partner backends that operate without a user in the session, this closes a gap that required workarounds. M2M access is restricted to apps created via the Management API or Dashboard — DCR-registered apps are excluded, maintaining the secure-by-default posture Auth0 introduced with third-party apps. Alongside that, the [GA release of Inbound SCIM Groups](/release/rel_CZMXeo7_6H1VymBjrajlF-auth0-inbound-scim-groups-for-enterprise-connections-now-generally-available) for Enterprise Connections lets you map synced groups directly to Auth0 roles at the tenant level or scoped per organization. When combined with Auto-Membership, users in synced groups inherit permissions at login without custom provisioning logic. WorkOS also shipped a complementary piece: [SCIM bearer token rotation](/release/rel_dDGXAx036yG9HkcKs1Vwn-workos-adds-scim-bearer-token-rotation) for directory integrations, now available from the Admin Portal and Directory Sync dashboard. Auth0's [Dashboard Search for Applications](/release/rel_4dbVxa-bxuvp-9Ao7K59G-auth0-dashboard-search-for-applications-now-in-public-beta) entered public beta, supporting real-time filtering by name, client ID, metadata, application type, and more (up to five combinable filters that persist via URL). The broader [Dashboard navigation refresh](/release/rel_mjyglJVjlnJLNoVYHt5qe-auth0-dashboard-navigation-and-information-architecture-refresh-now-in-beta) is also in beta, reorganizing pages around common tasks with flattened navigation. Existing bookmarks redirect automatically, and all underlying APIs are unchanged. ### Clerk fills in the organization-graph gaps After weeks of shipping steady improvements across its SDK matrix, Clerk's most consequential release for team-product developers this week came on the native side: the [Clerk iOS (1.2.0)](/release/rel_3CeEd_zlrviK9v7x_vvkK-clerk-ios-sdk-1-2-0-supports-swift-6-2-and-adds-session-reverification) and Android SDKs (via the [June 5 changelog](/release/rel_91Wxq8c92GCqkIRl9SL0y-clerk-ios-and-android-sdks-add-prebuilt-organization-management-ui)) now include prebuilt Organization management UI. The components cover the full spectrum — `OrganizationSwitcher` for account switching, `OrganizationListView` for standalone selection, and `OrganizationProfileView` with permission-gated management of members, domains, and org lifecycle actions. The iOS SDK also adds session reverification convenience APIs and bumps to Swift 6.2 and Xcode 26. On the backend, [`@clerk/backend` v3.5.0](/release/rel_K5TDSvVfZHi7h7DbXcqCU-clerk-javascript-sdk-clerk-backend-3-5-0-adds-user-email-and-phone-replacement) introduces long-requested user email and phone replacement APIs: `users.replaceUserEmailAddress` and `users.replaceUserPhoneNumber` let you overwrite all addresses with a single verified, primary value in one call. The same release fixes an issue where `authenticateRequest` was consuming the request body, preventing downstream handlers from reading it, and preserves custom claims during JWT-format M2M token verification. Framework SDKs for [Next.js](/release/rel_LlugBB3sviUlYr5OE5LYK-clerk-nextjs-v7-4-3-prevents-keyless-mode-in-ci-environments), [Nuxt](/release/rel_cDMmfBU5WpwiDW9apjRI7-clerk-javascript-sdk-clerk-nuxt-2-5-3-prevents-keyless-mode-in-ci), [Astro](/release/rel_QakV9q_H4tSXSxuH88-ao-clerk-astro-3-3-3-prevents-keyless-mode-in-ci-environments), [TanStack React Start](/release/rel_T__rdmJVVHg7BTyT4IxYa-clerk-javascript-sdk-clerk-tanstack-react-start-1-3-3-prevents-keyless-mode-in), and [React Router](/release/rel_19JGWZa2XOFkcgePijiQq-clerk-react-router-3-3-3-prevents-keyless-mode-in-ci-environments) coordinated to prevent keyless mode from activating in CI and other automated environments. ### Better Auth and Supabase round out the week [Better Auth v1.6.14](/release/rel_gPRTotnXo9UlzAN8yBC6Y-better-auth-v1-6-14-fixes-google-one-tap-account-mismatch-and-session-cookie) landed several high-severity fixes: Google One Tap no longer authenticates against the wrong user when the presented account is already linked to a different local user, `getSessionCookie` now prefers the `__Secure-` cookie over a non-secure leftover, and SAML Single Logout no longer leaves users signed in on the server. Supabase Auth continued its release-candidate cycle for v2.190.0 with three new RCs (rc.19, rc.22, rc.23), though the stable changelog remained quiet. Clerk also pushed a large batch of dependency updates across its JavaScript SDK, including [captcha-by-OAuth-provider fix](/release/rel_3AeGHBS7-J4hxtWFhgHY4-clerk-javascript-sdk-v5-125-13-fixes-oauth-users-hanging-on-sso-callback) that resolves a long-tail bug where new OAuth users would hang on the SSO callback. ## Releases covered ### Auth0 - [Auth0 M2M Support for Third-Party Applications is now Generally Available](https://releases.sh/release/rel_InkNqbTYHBlikNQPh3q3I-strict-third-party-apps-now-support-m2m-with-client-credentials) - [Auth0 Inbound SCIM Groups for Enterprise Connections now generally available](https://releases.sh/release/rel_CZMXeo7_6H1VymBjrajlF-scim-groups-map-to-auth0-roles-self-service-provisioning-added) - [Auth0 Dashboard Search for Applications now in public beta](https://releases.sh/release/rel_4dbVxa-bxuvp-9Ao7K59G-dashboard-application-search-launches-in-beta) - [Auth0 Dashboard navigation and information architecture refresh now in beta](https://releases.sh/release/rel_mjyglJVjlnJLNoVYHt5qe-dashboard-navigation-redesigned-flattened-sidebar-and-reorganized-pages) ### Better Auth - [better-auth v1.6.14 fixes Google One Tap account mismatch and session cookie shadowing](https://releases.sh/release/rel_gPRTotnXo9UlzAN8yBC6Y-google-one-tap-no-longer-authenticates-wrong-user-stale-session-cookies-fixed) ### Clerk - [Clerk iOS SDK 1.2.0 supports Swift 6.2 and adds session reverification](https://releases.sh/release/rel_3CeEd_zlrviK9v7x_vvkK-swift-6-2-support-session-reverification-conveniences-added) - [Clerk iOS and Android SDKs add prebuilt Organization management UI](https://releases.sh/release/rel_91Wxq8c92GCqkIRl9SL0y-prebuilt-organization-ui-comes-to-ios-android) - [Clerk JavaScript SDK @clerk/backend@3.5.0 adds user email and phone replacement APIs](https://releases.sh/release/rel_K5TDSvVfZHi7h7DbXcqCU-user-email-phone-replacement-endpoints-added-request-body-consumption-fixed) - [@clerk/nextjs v7.4.3 prevents keyless mode in CI environments](https://releases.sh/release/rel_LlugBB3sviUlYr5OE5LYK-keyless-mode-disabled-in-ci-and-automated-environments) - [Clerk JavaScript SDK @clerk/nuxt@2.5.3 prevents keyless mode in CI](https://releases.sh/release/rel_cDMmfBU5WpwiDW9apjRI7-keyless-mode-disabled-in-ci-and-automated-environments) - [@clerk/astro@3.3.3 prevents keyless mode in CI environments](https://releases.sh/release/rel_QakV9q_H4tSXSxuH88-ao-keyless-mode-disabled-in-ci-and-automated-environments) - [Clerk JavaScript SDK @clerk/tanstack-react-start@1.3.3 prevents keyless mode in CI](https://releases.sh/release/rel_T__rdmJVVHg7BTyT4IxYa-keyless-mode-blocked-in-ci-environments) - [@clerk/react-router@3.3.3 prevents keyless mode in CI environments](https://releases.sh/release/rel_19JGWZa2XOFkcgePijiQq-keyless-mode-blocked-in-ci-development-warning-now-suppressible-via-env-var-in) - [Clerk JavaScript SDK v5.125.13 fixes OAuth users hanging on SSO callback](https://releases.sh/release/rel_3AeGHBS7-J4hxtWFhgHY4-oauth-sign-in-to-sign-up-flow-no-longer-hangs-on-captcha) ### WorkOS - [WorkOS adds SCIM bearer token rotation](https://releases.sh/release/rel_dDGXAx036yG9HkcKs1Vwn-scim-bearer-tokens-now-rotatable)