--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-07-27 title: Agent identities, self-serve SSO, and org-scoped controls release_count: 89 generated: 2026-08-03 canonical: https://releases.sh/collections/auth-identity/digest/2026-07-27 --- # Agent identities, self-serve SSO, and org-scoped controls Auth0 gave AI agents first-class identities and launched Privileged Worker for token retrieval, while Clerk made self-serve OIDC SSO generally available. Both platforms also shipped new organization-level access controls. ### Agent identities and token retrieval Auth0 kicked off the week with two major early access releases that reshape how AI agents authenticate. [Agents as Principal](/release/rel_PLloK7eoL5GNW7wUxeEs4-auth0-launches-agents-as-principal-early-access-with-unique-agent-identities) gives every agent its own unique identity, credentials, and audit trail in Auth0, distinct from both human users and shared client IDs. The delegation chain from user to agent to app is now encoded in tokens and fully auditable end-to-end. Complementing that, [Privileged Worker](/release/rel_1-Eh-HHxjid2WGrYz0FL7-auth0-launches-privileged-worker-early-access-for-autonomous-agent-token) lets background agents authenticate with Private Key JWT or mTLS to pull a user's third-party tokens from Token Vault without requiring a signed-in user session — critical for agents running on schedules, in CI, or at 2am with no one logged in. ### Self-serve OIDC and organization controls Clerk made [self-serve OIDC SSO configuration](/release/rel_iv8Rq1Ytj57Bh9InrBqPp-clerk-adds-self-serve-oidc-sso-configuration-for-organization-customers) generally available for all Organization customers, letting IT admins configure custom OpenID Connect connections from the Security tab in `` alongside existing SAML support. The `experimental.oidcSelfServe` option is now a no-op and can be removed from `ClerkProvider` and `Clerk.load()`. Several SDK packages — including the [JavaScript SDK](/release/rel_hudjtph7HZQJpvtkHJVTe-clerk-javascript-sdk-6-25-13-enables-self-serve-oidc-configuration), [UI](/release/rel_g08pC1bp28S7RpP37nxQU-clerk-ui-v1-27-2-enables-self-serve-oidc-configuration-for-all-apps), and [shared](/release/rel_4PdwmCYebBSb6HOWtBWei-clerk-javascript-sdk-shared-v4-25-10-enables-self-serve-oidc-for-all) — shipped the enablement in lockstep. Meanwhile, the `@clerk/nuxt` [v3.0.0](/release/rel_L0xx8IhTc1u9RWyZIVVFT-clerk-nuxt-v3-0-0-drops-nuxt-3-and-removes-createroutematcher) drops support for Nuxt 3 (which reaches end-of-life on July 31) and requires Nuxt 4 with Node.js ^20.19.0 or >=22.12.0. Auth0 also expanded its organization toolkit with three early access releases: [organization-level roles](/release/rel_-c93AZe_F27081LaBEy5I-auth0-introduces-organization-level-roles-in-early-access) let you create, update, and delete roles scoped to individual organizations without metadata workarounds; [Organization-to-Application Entitlement](/release/rel_PLata0k2xLInqcK_RFzo6-auth0-launches-organization-to-application-entitlement-early-access) controls which apps org members can access natively, without custom code; and [Enterprise Connect](/release/rel_OIJ2AgMG3MFczsdXeb_mK-auth0-enterprise-connect-enters-beta-adding-modular-b2b-identity-federation) lets Auth0 serve as a modular B2B identity layer by federating existing SAML or OIDC authorization servers. ### Development tooling and security hardening WorkOS released @workos/emulate, an open-source local API server for testing WorkOS integrations in CI/CD without hitting a live environment — it supports seeding users, organizations, RBAC, and SSO connections, including end-to-end AuthKit flows. WorkOS also added [API key authentication](/release/rel_RmCzXsMeLx53UM-PV658X-workos-pipes-adds-api-key-authentication-for-providers-without-oauth) for Pipes providers that don't offer OAuth. Auth0 shipped [Curated Blocklists](/release/rel_vwd-9FDvAgV2bLZPGwk_3-auth0-adds-curated-blocklists-to-tenant-acls-with-threat-intelligence-feeds) for Tenant ACLs, integrating threat intelligence feeds that cover low-reputation IPs, TOR exit nodes, proxies, VPNs, and iCloud Private Relay — configured via the `auth0_managed` array in the Network ACLs Management API. The [Global Search](/release/rel_fjHS9RvOCkpuhKB9d432s-auth0-adds-global-search-in-cmd-k-beta) Beta brings entity search for Applications, APIs, Organizations, and Users to the Auth0 Dashboard Cmd+K command palette. Clerk fixed a [Safari ITP cookie refresh issue](/release/rel_GwAzara-gArDYs7eIvdGQ-clerk-js-sdk-6-25-12-fixes-safari-itp-cookie-refresh-on-sign-out) on sign-out that was treating returning users as new devices after 7 days, and the [Expo SDK](/release/rel_rbHJm1495UGcGYnHTra_Z-clerk-expo-v4-2-0-adds-experimental-usesso-hook-and-native-navigation-support) added an experimental `useSSO()` hook and native navigation support. The [iOS SDK](/release/rel_zZwNTA6g1H1y8kDhZXdk_-clerk-ios-sdk-1-3-5-adds-hosted-authentication) added hosted authentication, and the [Electron SDK](/release/rel_6NJ2yU2fSuma6ekGXpwdP-clerk-electron-v0-0-24-forwards-oauth-deep-link-callbacks-on-windows-and-linux) now forwards OAuth deep-link callbacks on Windows and Linux. ## Releases covered ### Auth0 - [Auth0 launches Agents as Principal Early Access with unique agent identities](https://releases.sh/release/rel_PLloK7eoL5GNW7wUxeEs4-ai-agents-get-first-class-identities-in-auth0-delegation-chain-auditable) - [Auth0 launches Privileged Worker Early Access for autonomous agent token retrieval](https://releases.sh/release/rel_1-Eh-HHxjid2WGrYz0FL7-autonomous-agents-pull-user-tokens-without-a-session) - [Auth0 introduces organization-level roles in Early Access](https://releases.sh/release/rel_-c93AZe_F27081LaBEy5I-organization-level-roles-now-in-early-access) - [Auth0 launches Organization-to-Application Entitlement early access](https://releases.sh/release/rel_PLata0k2xLInqcK_RFzo6-control-which-apps-org-members-can-access-natively) - [Auth0 Enterprise Connect enters Beta, adding modular B2B identity federation](https://releases.sh/release/rel_OIJ2AgMG3MFczsdXeb_mK-enterprise-connect-beta-federate-saml-oidc-servers-into-auth0) - [Auth0 adds curated blocklists to Tenant ACLs with threat intelligence feeds](https://releases.sh/release/rel_vwd-9FDvAgV2bLZPGwk_3-curated-blocklists-integrate-threat-intel-into-tenant-acls) - [Auth0 adds Global Search in Cmd+K Beta](https://releases.sh/release/rel_fjHS9RvOCkpuhKB9d432s-global-search-ships-in-cmd-k-beta) ### Clerk - [Clerk adds self-serve OIDC SSO configuration for Organization customers](https://releases.sh/release/rel_iv8Rq1Ytj57Bh9InrBqPp-organization-it-admins-can-self-configure-oidc-sso) - [Clerk JavaScript SDK 6.25.13 enables self-serve OIDC configuration](https://releases.sh/release/rel_hudjtph7HZQJpvtkHJVTe-oidc-config-self-serve-for-all-apps-flag-removed) - [Clerk UI v1.27.2 enables self-serve OIDC configuration for all apps](https://releases.sh/release/rel_g08pC1bp28S7RpP37nxQU-self-serve-oidc-configuration-now-available-to-all-apps) - [Clerk JavaScript SDK shared v4.25.10 enables self-serve OIDC for all organizations](https://releases.sh/release/rel_4PdwmCYebBSb6HOWtBWei-self-serve-oidc-available-to-all-organizations) - [@clerk/nuxt v3.0.0 drops Nuxt 3 and removes createRouteMatcher](https://releases.sh/release/rel_L0xx8IhTc1u9RWyZIVVFT-nuxt-3-support-dropped-createroutematcher-removed) - [Clerk JS SDK 6.25.12 fixes Safari ITP cookie refresh on sign-out](https://releases.sh/release/rel_GwAzara-gArDYs7eIvdGQ-sign-out-no-longer-confuses-safari-itp-after-7-days-device-recognized-correctly) - [Clerk Expo v4.2.0 adds experimental useSSO hook and native navigation support](https://releases.sh/release/rel_rbHJm1495UGcGYnHTra_Z-experimental-usesso-hook-native-userprofileview-and-authview-navigation) - [Clerk iOS SDK 1.3.5 adds hosted authentication](https://releases.sh/release/rel_zZwNTA6g1H1y8kDhZXdk_-hosted-authentication-added) - [Clerk Electron v0.0.24 forwards OAuth deep-link callbacks on Windows and Linux](https://releases.sh/release/rel_6NJ2yU2fSuma6ekGXpwdP-oauth-deep-link-callbacks-now-forwarded-on-windows-and-linux) ### WorkOS - [WorkOS Pipes adds API key authentication for providers without OAuth](https://releases.sh/release/rel_RmCzXsMeLx53UM-PV658X-pipes-now-manages-api-keys-alongside-oauth-tokens)