Identity platforms open up token exchange, audit trails, and biometric sign-in

Token exchange moves to the center

The week's biggest shift came from Auth0, which took Custom Token Exchange out of preview and made it generally available to Enterprise, B2B Professional, and B2C Professional customers plus trial tenants. The feature lets an application swap a token issued by Auth0 or an external identity provider for Auth0 access, ID, and refresh tokens, with the exchange logic written as Actions you control end to end. That matters most for delegated authorization — services acting on behalf of a user now have a supported path to mint the right tokens instead of inventing one.

Auth0 also started acting as the requesting application in Cross-App Access flows in Early Access. Built on Token Vault and the ID-JAG protocol, it lets apps that authenticate enterprise users fetch third-party API tokens directly, with org-aware connection resolution across OIDC and Okta Workforce connections. For AI agents, assistants, and ISVs onboarding enterprise customers, that removes the per-integration, per-user "Connect your account" click that has been the standard friction point.

Auditability and step-up controls

Clerk focused on the administrative side of identity. Admin Logs now record configuration changes made through the Dashboard, Backend API, or Platform API, filterable by event type, instance, application, actor, IP address, and time range — an audit trail for teams that need to answer "who changed this, and when." Recording began August 24, 2026 on Business and Enterprise plans, and earlier activity isn't included. Separately, Clerk made the reverification window for sensitive actions configurable, so you can require a fresher sign-in — anywhere from one to ten minutes — before password changes, email edits, session revocation, or account deletion. The default stays at ten minutes.

Mobile credentials and the long tail of SDK patches

Clerk's mobile and JavaScript surfaces had a busy week. The iOS SDK added passkeys as a second factor and renamed trusted devices to biometric credentials, then followed up with a fix for environment propagation into nested sheets that could make embedded views misbehave. On the JavaScript side, Expo gained biometric credential enrollment, management, and sign-in, with the old trusted-device exports kept as deprecated aliases. Clerk also cleaned up two long-standing sign-in headaches: OAuth account transfers that needed extra verification no longer dump users back at the start of sign-in, and navigation now stays inside the renderer rather than navigating the window to internal virtual paths that reloaded the renderer and dropped users mid-flow — a fix that reached Electron users too, who can drop their no-op router workarounds. A verification that was still progressing normally also stopped being cancelled and reported as a timeout. Most remaining JavaScript packages took dependency-only bumps.

Elsewhere, WorkOS added group management and role assignment in the Dashboard, where roles granted to a group flow automatically to current and future members, and shipped a Waitlist API that swaps the signup form for a waitlist form you can approve or deny programmatically or through its MCP server. Better Auth's release cleared stale expiration dates from permanent bans and tightened relative callback and redirect URL validation, alongside fixes for Cloudflare Workers async context and D1 migrations. Supabase Auth continued cutting release candidates for its next version, and several smaller releases rounded out the week without user-facing changes.