--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-06-29 title: Browsers, bots, and billing release_count: 50 generated: 2026-07-11 canonical: https://releases.sh/collections/auth-identity/digest/2026-06-29 --- # Browsers, bots, and billing WorkOS shipped a browser-facing GraphQL API and an MCP server for AI management, Auth0 pushed SCIM provisioning to downstream apps via Event Streams, and Clerk added account credits UI and OAuth token revocation. ### Data to the frontend and the agent WorkOS had its most consequential week in months with two entirely new surfaces for interacting with its platform — one for browsers, one for AI agents. The [Widgets API](/release/rel_3kepni0f6U59V6Z0lLPJU-workos-launches-widgets-api-for-browser-based-graphql-queries) is a session-aware GraphQL API that lets the browser query WorkOS data directly using short-lived, origin-pinned tokens. Until now, pulling user details or roles into a custom UI meant either using WorkOS's prebuilt React Widgets (fast but inflexible) or writing your own backend proxy to call the REST API. The Widgets API eliminates that proxy: a coding agent can introspect the schema and write queries without any docs, and you can build an experience that fetches a user's details, roles, and sessions from a single `POST` on the client. It currently covers user management, sessions, and profile data. On the same day, WorkOS launched the [Management MCP Server](/release/rel_keGkGmrqT7El46lUpnwyi-workos-launches-management-mcp-server-for-ai-driven-resource-management), a Model Context Protocol server that lets Claude and other AI assistants manage WorkOS resources through natural language — user management, organizations, directory sync, audit logs, and role-based access control. Where the Widgets API is read-first and browser-oriented, the MCP server is write-capable and assistant-oriented; together they offer two complementary paths into WorkOS data without writing REST boilerplate. ### Step-up auth and outbound SCIM WorkOS also shipped [step-up authentication](/release/rel_3s5cCpNPOXgwU6Q4I8eD2-workos-launches-step-up-authentication-for-sensitive-operations), the long-requested feature that forces re-authentication or additional verification before sensitive operations — changing a password, updating a payment method, accessing an admin panel. It's configurable per-endpoint and protects accounts even when a session token is compromised. Over at Auth0, the [Outbound SCIM Action template for Event Streams](/release/rel_qk5EDtvqVWtBOtyazwsTq-auth0-launches-outbound-scim-action-template-for-event-streams) pushes `user.created`, `user.updated`, and `user.deleted` events to any SCIM 2.0-compliant downstream application without requiring infrastructure. It's a ready-to-copy Action template with built-in fault tolerance and template-driven attribute mapping — essentially a zero-infrastructure path to provisioning downstream HR or IT systems from Auth0 user events. ### Clerk broadens billing and backend surface Clerk's Thursday drop was dominated by the `@clerk/backend@3.9.0` release, which added `clerkClient.oauthApplications.revokeToken()` for revoking OAuth application tokens and hardened `organizations.deleteOrganization()` with validation that prevents issuing a DELETE request to the collection endpoint when no ID is provided. M2M JWT verification now rejects tokens with mismatched categories. The JS SDK also picked up [account credits UI](/release/rel_-YPQlfJhFlQ1m1Ng5X8-W-clerk-javascript-sdk-v6-23-0-adds-account-credits-ui-and-fixes-oauth-transport): payers with an existing credit balance now see an account credits section and credit history page in the billing tab. This is supported across `clerk-js`, Clerk UI, and the localizations package — the pattern of shipping a new billing feature to all three simultaneously has become routine for Clerk. The next backend minor release, `@clerk/backend@3.10.0`, added an [experimental `clerkClient.emails.create()`](/release/rel_nHXpvOnGjyc_a4tQED-vg-clerk-backend-v3-10-0-adds-experimental-send-email-method) method for sending transactional emails, supporting address- or user-based recipients, subject, and HTML or text content. A dozen framework packages (Next.js, Nuxt, Astro, Fastify, Hono, Express, React Router, TanStack Start, Remix, Vue, and Chrome Extension) rolled up these backend changes in patch bumps, and the Electron package [auto-allowlisted custom schemes](/release/rel_2HN6DqQTgmTQKOsp6Lkoz-clerk-electron-v0-0-8-auto-allowlists-custom-schemes-for-renderer-redirect) for renderer redirect protocols. Better Auth, meanwhile, shipped `v1.7.0-rc.1` with [Yandex OAuth support](/release/rel_SipDISKR8qgADmBOuDSt_-better-auth-v1-7-0-rc-1-adds-yandex-oauth-and-fixes-auth-migrate-schema-issues) and fixes to `auth migrate`. ## Releases covered ### Auth0 - [Auth0 launches outbound SCIM Action template for Event Streams](https://releases.sh/release/rel_qk5EDtvqVWtBOtyazwsTq-outbound-scim-provisioning-via-event-streams) ### Better Auth - [better-auth v1.7.0-rc.1 adds Yandex OAuth and fixes auth migrate schema issues](https://releases.sh/release/rel_SipDISKR8qgADmBOuDSt_-yandex-oauth-provider-added-auth-migrate-no-longer-aborts-on-new-columns) ### Clerk - [Clerk JavaScript SDK v6.23.0 adds account credits UI and fixes OAuth transport](https://releases.sh/release/rel_-YPQlfJhFlQ1m1Ng5X8-W-account-credits-page-for-payers-oauth-transport-fixed) - [@clerk/backend v3.10.0 adds experimental send email method](https://releases.sh/release/rel_nHXpvOnGjyc_a4tQED-vg-clerkclient-now-sends-transactional-emails-experimental) - [Clerk Electron v0.0.8 auto-allowlists custom schemes for renderer redirect protocols](https://releases.sh/release/rel_2HN6DqQTgmTQKOsp6Lkoz-custom-scheme-auto-allowlisted-for-renderer-redirects) ### WorkOS - [WorkOS launches Widgets API for browser-based GraphQL queries](https://releases.sh/release/rel_3kepni0f6U59V6Z0lLPJU-widgets-api-graphql-for-browser-schema-introspectable) - [WorkOS launches Management MCP Server for AI-driven resource management](https://releases.sh/release/rel_keGkGmrqT7El46lUpnwyi-management-mcp-server-for-workos-resources) - [WorkOS launches step-up authentication for sensitive operations](https://releases.sh/release/rel_3s5cCpNPOXgwU6Q4I8eD2-step-up-auth-for-sensitive-operations)