--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-06-01 title: The week M2M went multi-tenant and SCIM closed the loop release_count: 41 generated: 2026-07-11 canonical: https://releases.sh/collections/auth-identity/digest/2026-06-01 --- # The week M2M went multi-tenant and SCIM closed the loop Auth0 shipped machine-to-machine access for third-party applications and made Inbound SCIM Groups generally available, while Clerk rolled out prebuilt organization management UI across its native mobile SDKs and a major backend API update. ### M2M access for third-party apps and SCIM group mapping at scale Auth0 took two significant steps forward in API-first, multi-tenant identity this week. [Strict third-party applications](https://auth0.com/changelog#2tvGxAGzcIJemzFFN67Yfc) now support the `client_credentials` grant type for machine-to-machine access, including the ability to scope M2M tokens to specific organizations. For teams exposing APIs to AI agents or partner backends that operate without a user in the session, this closes a gap that required workarounds. M2M access is restricted to apps created via the Management API or Dashboard — DCR-registered apps are excluded, maintaining the secure-by-default posture Auth0 introduced with third-party apps. Alongside that, the [GA release of Inbound SCIM Groups](https://auth0.com/changelog#3JIQlpZIUJmq1diRBXKZUd) for Enterprise Connections lets you map synced groups directly to Auth0 roles at the tenant level or scoped per organization. When combined with Auto-Membership, users in synced groups inherit permissions at login without custom provisioning logic. WorkOS also shipped a complementary piece: [SCIM bearer token rotation](https://workos.com/changelog/scim-bearer-token-rotation) for directory integrations, now available from the Admin Portal and Directory Sync dashboard. Auth0's [Dashboard Search for Applications](https://auth0.com/changelog#4pl2qmNBc5YGkSnfArJQJD) entered public beta, supporting real-time filtering by name, client ID, metadata, application type, and more (up to five combinable filters that persist via URL). The broader [Dashboard navigation refresh](https://auth0.com/changelog#1bJBNHLBIg4ZrsCHnxZYWZ) is also in beta, reorganizing pages around common tasks with flattened navigation. Existing bookmarks redirect automatically, and all underlying APIs are unchanged. ### Clerk fills in the organization-graph gaps After weeks of shipping steady improvements across its SDK matrix, Clerk's most consequential release for team-product developers this week came on the native side: the [Clerk iOS (1.2.0)](https://github.com/clerk/clerk-ios/releases/tag/1.2.0) and Android SDKs (via the [June 5 changelog](https://clerk.com/changelog/2026-06-05-ios-android-organization-management)) now include prebuilt Organization management UI. The components cover the full spectrum — `OrganizationSwitcher` for account switching, `OrganizationListView` for standalone selection, and `OrganizationProfileView` with permission-gated management of members, domains, and org lifecycle actions. The iOS SDK also adds session reverification convenience APIs and bumps to Swift 6.2 and Xcode 26. On the backend, [`@clerk/backend` v3.5.0](https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.5.0) introduces long-requested user email and phone replacement APIs: `users.replaceUserEmailAddress` and `users.replaceUserPhoneNumber` let you overwrite all addresses with a single verified, primary value in one call. The same release fixes an issue where `authenticateRequest` was consuming the request body, preventing downstream handlers from reading it, and preserves custom claims during JWT-format M2M token verification. Framework SDKs for [Next.js](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.4.3), [Nuxt](https://github.com/clerk/javascript/releases/tag/%40clerk/nuxt%402.5.3), [Astro](https://github.com/clerk/javascript/releases/tag/%40clerk/astro%403.3.3), [TanStack React Start](https://github.com/clerk/javascript/releases/tag/%40clerk/tanstack-react-start%401.3.3), and [React Router](https://github.com/clerk/javascript/releases/tag/%40clerk/react-router%403.3.3) coordinated to prevent keyless mode from activating in CI and other automated environments. ### Better Auth and Supabase round out the week [Better Auth v1.6.14](https://github.com/better-auth/better-auth/releases/tag/v1.6.14) landed several high-severity fixes: Google One Tap no longer authenticates against the wrong user when the presented account is already linked to a different local user, `getSessionCookie` now prefers the `__Secure-` cookie over a non-secure leftover, and SAML Single Logout no longer leaves users signed in on the server. Supabase Auth continued its release-candidate cycle for v2.190.0 with three new RCs (rc.19, rc.22, rc.23), though the stable changelog remained quiet. Clerk also pushed a large batch of dependency updates across its JavaScript SDK, including [captcha-by-OAuth-provider fix](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%405.125.13) that resolves a long-tail bug where new OAuth users would hang on the SSO callback. ## Releases covered ### Auth0 - [Auth0 M2M Support for Third-Party Applications is now Generally Available](https://auth0.com/changelog#2tvGxAGzcIJemzFFN67Yfc) - [Auth0 Inbound SCIM Groups for Enterprise Connections now generally available](https://auth0.com/changelog#3JIQlpZIUJmq1diRBXKZUd) - [Auth0 Dashboard Search for Applications now in public beta](https://auth0.com/changelog#4pl2qmNBc5YGkSnfArJQJD) - [Auth0 Dashboard navigation and information architecture refresh now in beta](https://auth0.com/changelog#1bJBNHLBIg4ZrsCHnxZYWZ) ### Better Auth - [better-auth v1.6.14 fixes Google One Tap account mismatch and session cookie shadowing](https://github.com/better-auth/better-auth/releases/tag/v1.6.14) ### Clerk - [Clerk iOS SDK 1.2.0 supports Swift 6.2 and adds session reverification](https://github.com/clerk/clerk-ios/releases/tag/1.2.0) - [Clerk iOS and Android SDKs add prebuilt Organization management UI](https://clerk.com/changelog/2026-06-05-ios-android-organization-management) - [Clerk JavaScript SDK @clerk/backend@3.5.0 adds user email and phone replacement APIs](https://github.com/clerk/javascript/releases/tag/%40clerk/backend%403.5.0) - [@clerk/nextjs v7.4.3 prevents keyless mode in CI environments](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.4.3) - [Clerk JavaScript SDK @clerk/nuxt@2.5.3 prevents keyless mode in CI](https://github.com/clerk/javascript/releases/tag/%40clerk/nuxt%402.5.3) - [@clerk/astro@3.3.3 prevents keyless mode in CI environments](https://github.com/clerk/javascript/releases/tag/%40clerk/astro%403.3.3) - [Clerk JavaScript SDK @clerk/tanstack-react-start@1.3.3 prevents keyless mode in CI](https://github.com/clerk/javascript/releases/tag/%40clerk/tanstack-react-start%401.3.3) - [@clerk/react-router@3.3.3 prevents keyless mode in CI environments](https://github.com/clerk/javascript/releases/tag/%40clerk/react-router%403.3.3) - [Clerk JavaScript SDK v5.125.13 fixes OAuth users hanging on SSO callback](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%405.125.13) ### WorkOS - [WorkOS adds SCIM bearer token rotation](https://workos.com/changelog/scim-bearer-token-rotation)