{"collection":{"slug":"auth-identity","name":"Auth & Identity"},"digest":{"id":"cwd_JkU6qEadPHvZMkX2xhI2c","weekStart":"2026-08-24","title":"Identity platforms open up token exchange, audit trails, and biometric sign-in","intro":"Auth0 made Custom Token Exchange generally available and began acting as the requesting app in Cross-App Access flows, while Clerk opened Admin Logs audit trails, let teams tune the reverification window, and brought biometric credentials and passkeys to mobile.","body":"### Token exchange moves to the center\n\nThe week's biggest shift came from Auth0, which took [Custom Token Exchange out of preview and made it generally available](/release/rel_7TYXwT8v4hNspxTaq669C-auth0-custom-token-exchange-is-now-generally-available) to Enterprise, B2B Professional, and B2C Professional customers plus trial tenants. The feature lets an application swap a token issued by Auth0 or an external identity provider for Auth0 access, ID, and refresh tokens, with the exchange logic written as Actions you control end to end. That matters most for delegated authorization — services acting on behalf of a user now have a supported path to mint the right tokens instead of inventing one.\n\nAuth0 also started [acting as the requesting application in Cross-App Access flows](/release/rel_W0U7SBAiElwqhKXYS8TOU-auth0-adds-cross-app-access-requesting-app-in-early-access) in Early Access. Built on Token Vault and the ID-JAG protocol, it lets apps that authenticate enterprise users fetch third-party API tokens directly, with org-aware connection resolution across OIDC and Okta Workforce connections. For AI agents, assistants, and ISVs onboarding enterprise customers, that removes the per-integration, per-user \"Connect your account\" click that has been the standard friction point.\n\n### Auditability and step-up controls\n\nClerk focused on the administrative side of identity. [Admin Logs](/release/rel_zoUh-NJOKcfpaSmnaPIhS-clerk-adds-admin-logs-audit-trail-for-dashboard-backend-and-platform-api-actions) now record configuration changes made through the Dashboard, Backend API, or Platform API, filterable by event type, instance, application, actor, IP address, and time range — an audit trail for teams that need to answer \"who changed this, and when.\" Recording began August 24, 2026 on Business and Enterprise plans, and earlier activity isn't included. Separately, Clerk made the [reverification window for sensitive actions configurable](/release/rel_GKI2aaXRr0clkE7oXc9Om-clerk-lets-you-customize-the-reverification-window-for-sensitive-actions), so you can require a fresher sign-in — anywhere from one to ten minutes — before password changes, email edits, session revocation, or account deletion. The default stays at ten minutes.\n\n### Mobile credentials and the long tail of SDK patches\n\nClerk's mobile and JavaScript surfaces had a busy week. The [iOS SDK added passkeys as a second factor](/release/rel_MM3WgjgJMM3X2oTJKfiAS-clerk-ios-sdk-1-5-0-adds-passkeys-as-a-second-factor) and renamed trusted devices to biometric credentials, then followed up with a [fix for environment propagation into nested sheets](/release/rel_XXJwfsO9f8XEcOqKamTJO-clerk-ios-sdk-1-5-1-forwards-environment-into-nested-sheets) that could make embedded views misbehave. On the JavaScript side, Expo gained [biometric credential enrollment, management, and sign-in](/release/rel_4WnnM0v6qpwZKcaCNFnEs-clerk-expo-4-6-0-adds-biometric-credentials-with-enrollment-and-sign-in), with the old trusted-device exports kept as deprecated aliases. Clerk also cleaned up two long-standing sign-in headaches: [OAuth account transfers that needed extra verification no longer dump users back at the start of sign-in](/release/rel_I92udC5D8dsmNiNNobwCx-clerk-javascript-sdk-v6-30-0-fixes-oauth-transfer-verification-loop), and [navigation now stays inside the renderer](/release/rel_HAOJXoDVTTYdpBpZqCgaa-clerk-js-sdk-v4-30-0-keeps-navigation-in-renderer-fixing-sign-in-drops) rather than navigating the window to internal virtual paths that reloaded the renderer and dropped users mid-flow — a fix that reached Electron users too, who can [drop their no-op router workarounds](/release/rel_jhjZplhddZiOS8qpyanJJ-clerk-electron-v0-0-36-keeps-navigation-in-the-renderer). A verification that was still progressing normally also [stopped being cancelled and reported as a timeout](/release/rel_I3H4_l-XMXlNROr8Nx4yq-clerk-javascript-sdk-6-30-1-fixes-premature-verification-timeout-reporting). Most remaining JavaScript packages took dependency-only bumps.\n\nElsewhere, WorkOS added [group management and role assignment in the Dashboard](/release/rel_WPX5999CGTBlure2_PzAT-workos-adds-group-management-and-roles-in-the-dashboard), where roles granted to a group flow automatically to current and future members, and shipped a [Waitlist API](/release/rel_62ZdIoUSE6LTZ-5ITYVBJ-workos-adds-waitlist-api-with-self-serve-setup-for-gating-launches) that swaps the signup form for a waitlist form you can approve or deny programmatically or through its MCP server. Better Auth's release [cleared stale expiration dates from permanent bans and tightened relative callback and redirect URL validation](/release/rel_B8x6W-t0y19m_xo8ypy3a-better-auth-v1-7-2-clears-stale-ban-expiration-dates-and-hardens-redirect), alongside fixes for Cloudflare Workers async context and D1 migrations. Supabase Auth continued cutting release candidates for its next version, and several smaller releases rounded out the week without user-facing changes.","releaseIds":["rel_7TYXwT8v4hNspxTaq669C","rel_W0U7SBAiElwqhKXYS8TOU","rel_zoUh-NJOKcfpaSmnaPIhS","rel_GKI2aaXRr0clkE7oXc9Om","rel_MM3WgjgJMM3X2oTJKfiAS","rel_XXJwfsO9f8XEcOqKamTJO","rel_4WnnM0v6qpwZKcaCNFnEs","rel_I92udC5D8dsmNiNNobwCx","rel_HAOJXoDVTTYdpBpZqCgaa","rel_jhjZplhddZiOS8qpyanJJ","rel_I3H4_l-XMXlNROr8Nx4yq","rel_WPX5999CGTBlure2_PzAT","rel_62ZdIoUSE6LTZ-5ITYVBJ","rel_B8x6W-t0y19m_xo8ypy3a"],"releaseCount":54,"generatedAt":"2026-09-23T12:50:49.031Z","releases":[{"id":"rel_7TYXwT8v4hNspxTaq669C","title":"Auth0 custom token exchange is now generally available","path":"/release/rel_7TYXwT8v4hNspxTaq669C-custom-token-exchange-reaches-ga","url":"https://auth0.com/changelog#2yG3A8gOmC84RAUhJGovAq","org":{"slug":"auth0","name":"Auth0","avatarUrl":"https://media.releases.sh/orgs/auth0.png","githubHandle":"auth0"},"product":null,"importance":4},{"id":"rel_W0U7SBAiElwqhKXYS8TOU","title":"Auth0 adds Cross-App Access requesting app in Early Access","path":"/release/rel_W0U7SBAiElwqhKXYS8TOU-cross-app-access-requesting-app-now-in-early-access","url":"https://auth0.com/changelog#5Ki3dgMvxKBIofMldOI1ie","org":{"slug":"auth0","name":"Auth0","avatarUrl":"https://media.releases.sh/orgs/auth0.png","githubHandle":"auth0"},"product":null,"importance":3},{"id":"rel_zoUh-NJOKcfpaSmnaPIhS","title":"Clerk adds Admin Logs audit trail for Dashboard, Backend, and Platform API actions","path":"/release/rel_zoUh-NJOKcfpaSmnaPIhS-admin-logs-audit-trail-covers-all-admin-actions","url":"https://clerk.com/changelog/2026-08-25-admin-logs","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_GKI2aaXRr0clkE7oXc9Om","title":"Clerk lets you customize the reverification window for sensitive actions","path":"/release/rel_GKI2aaXRr0clkE7oXc9Om-reverification-window-customizable-1-10-min","url":"https://clerk.com/changelog/2026-08-28-customize-reverification-window","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_MM3WgjgJMM3X2oTJKfiAS","title":"Clerk iOS SDK 1.5.0 adds passkeys as a second factor","path":"/release/rel_MM3WgjgJMM3X2oTJKfiAS-passkeys-as-second-factor-trusted-devices-now-biometric-credentials","url":"https://github.com/clerk/clerk-ios/releases/tag/1.5.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_XXJwfsO9f8XEcOqKamTJO","title":"Clerk iOS SDK 1.5.1 forwards environment into nested sheets","path":"/release/rel_XXJwfsO9f8XEcOqKamTJO-nested-sheets-inherit-observable-environment","url":"https://github.com/clerk/clerk-ios/releases/tag/1.5.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_4WnnM0v6qpwZKcaCNFnEs","title":"Clerk Expo 4.6.0 adds biometric credentials with enrollment and sign-in","path":"/release/rel_4WnnM0v6qpwZKcaCNFnEs-biometric-sign-in-trusted-device-api-deprecates","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.6.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_I92udC5D8dsmNiNNobwCx","title":"Clerk JavaScript SDK v6.30.0 fixes OAuth transfer verification loop","path":"/release/rel_I92udC5D8dsmNiNNobwCx-oauth-transfers-no-longer-restart-sign-in","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.30.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_HAOJXoDVTTYdpBpZqCgaa","title":"Clerk JS SDK v4.30.0 keeps navigation in renderer, fixing sign-in drops","path":"/release/rel_HAOJXoDVTTYdpBpZqCgaa-navigation-stays-in-renderer-no-more-sign-in-drops-from-virtual-routes","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.30.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_jhjZplhddZiOS8qpyanJJ","title":"Clerk Electron v0.0.36 keeps navigation in the renderer","path":"/release/rel_jhjZplhddZiOS8qpyanJJ-navigation-stays-in-renderer","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/electron%400.0.36","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_I3H4_l-XMXlNROr8Nx4yq","title":"Clerk JavaScript SDK 6.30.1 fixes premature verification timeout reporting","path":"/release/rel_I3H4_l-XMXlNROr8Nx4yq-verification-no-longer-reported-as-timed-out-mid-flow","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.30.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_WPX5999CGTBlure2_PzAT","title":"WorkOS adds group management and roles in the Dashboard","path":"/release/rel_WPX5999CGTBlure2_PzAT-group-management-and-roles-now-in-the-dashboard","url":"https://workos.com/changelog/user-groups","org":{"slug":"workos","name":"WorkOS","avatarUrl":"https://media.releases.sh/orgs/workos.png","githubHandle":"workos"},"product":null,"importance":3},{"id":"rel_62ZdIoUSE6LTZ-5ITYVBJ","title":"WorkOS adds Waitlist API with self-serve setup for gating launches","path":"/release/rel_62ZdIoUSE6LTZ-5ITYVBJ-waitlist-api-gates-launches-agents-manage-entries-via-mcp","url":"https://workos.com/changelog/waitlist-api-and-self-serve-setup","org":{"slug":"workos","name":"WorkOS","avatarUrl":"https://media.releases.sh/orgs/workos.png","githubHandle":"workos"},"product":null,"importance":3},{"id":"rel_B8x6W-t0y19m_xo8ypy3a","title":"better-auth v1.7.2 clears stale ban expiration dates and hardens redirect validation","path":"/release/rel_B8x6W-t0y19m_xo8ypy3a-stale-ban-dates-cleared-redirect-validation-hardened","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.2","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":2}],"sections":[{"heading":"Token exchange moves to the center","anchor":"token-exchange-moves-to-the-center","lede":"The week's biggest shift came from Auth0, which took Custom Token Exchange out of preview and made it generally available to Enterprise, B2B Professional, and B2C Professional customers plus trial tenants.","releaseIds":["rel_7TYXwT8v4hNspxTaq669C","rel_W0U7SBAiElwqhKXYS8TOU"],"releases":[{"id":"rel_7TYXwT8v4hNspxTaq669C","title":"Auth0 custom token exchange is now generally available","path":"/release/rel_7TYXwT8v4hNspxTaq669C-custom-token-exchange-reaches-ga","url":"https://auth0.com/changelog#2yG3A8gOmC84RAUhJGovAq","org":{"slug":"auth0","name":"Auth0","avatarUrl":"https://media.releases.sh/orgs/auth0.png","githubHandle":"auth0"},"product":null,"importance":4},{"id":"rel_W0U7SBAiElwqhKXYS8TOU","title":"Auth0 adds Cross-App Access requesting app in Early Access","path":"/release/rel_W0U7SBAiElwqhKXYS8TOU-cross-app-access-requesting-app-now-in-early-access","url":"https://auth0.com/changelog#5Ki3dgMvxKBIofMldOI1ie","org":{"slug":"auth0","name":"Auth0","avatarUrl":"https://media.releases.sh/orgs/auth0.png","githubHandle":"auth0"},"product":null,"importance":3}]},{"heading":"Auditability and step-up controls","anchor":"auditability-and-step-up-controls","lede":"Clerk focused on the administrative side of identity.","releaseIds":["rel_zoUh-NJOKcfpaSmnaPIhS","rel_GKI2aaXRr0clkE7oXc9Om"],"releases":[{"id":"rel_zoUh-NJOKcfpaSmnaPIhS","title":"Clerk adds Admin Logs audit trail for Dashboard, Backend, and Platform API actions","path":"/release/rel_zoUh-NJOKcfpaSmnaPIhS-admin-logs-audit-trail-covers-all-admin-actions","url":"https://clerk.com/changelog/2026-08-25-admin-logs","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_GKI2aaXRr0clkE7oXc9Om","title":"Clerk lets you customize the reverification window for sensitive actions","path":"/release/rel_GKI2aaXRr0clkE7oXc9Om-reverification-window-customizable-1-10-min","url":"https://clerk.com/changelog/2026-08-28-customize-reverification-window","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3}]},{"heading":"Mobile credentials and the long tail of SDK patches","anchor":"mobile-credentials-and-the-long-tail-of-sdk-patches","lede":"Clerk's mobile and JavaScript surfaces had a busy week.","releaseIds":["rel_MM3WgjgJMM3X2oTJKfiAS","rel_XXJwfsO9f8XEcOqKamTJO","rel_4WnnM0v6qpwZKcaCNFnEs","rel_I92udC5D8dsmNiNNobwCx","rel_HAOJXoDVTTYdpBpZqCgaa","rel_jhjZplhddZiOS8qpyanJJ","rel_I3H4_l-XMXlNROr8Nx4yq","rel_WPX5999CGTBlure2_PzAT","rel_62ZdIoUSE6LTZ-5ITYVBJ","rel_B8x6W-t0y19m_xo8ypy3a"],"releases":[{"id":"rel_MM3WgjgJMM3X2oTJKfiAS","title":"Clerk iOS SDK 1.5.0 adds passkeys as a second factor","path":"/release/rel_MM3WgjgJMM3X2oTJKfiAS-passkeys-as-second-factor-trusted-devices-now-biometric-credentials","url":"https://github.com/clerk/clerk-ios/releases/tag/1.5.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_XXJwfsO9f8XEcOqKamTJO","title":"Clerk iOS SDK 1.5.1 forwards environment into nested sheets","path":"/release/rel_XXJwfsO9f8XEcOqKamTJO-nested-sheets-inherit-observable-environment","url":"https://github.com/clerk/clerk-ios/releases/tag/1.5.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_4WnnM0v6qpwZKcaCNFnEs","title":"Clerk Expo 4.6.0 adds biometric credentials with enrollment and sign-in","path":"/release/rel_4WnnM0v6qpwZKcaCNFnEs-biometric-sign-in-trusted-device-api-deprecates","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.6.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":3},{"id":"rel_I92udC5D8dsmNiNNobwCx","title":"Clerk JavaScript SDK v6.30.0 fixes OAuth transfer verification loop","path":"/release/rel_I92udC5D8dsmNiNNobwCx-oauth-transfers-no-longer-restart-sign-in","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.30.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_HAOJXoDVTTYdpBpZqCgaa","title":"Clerk JS SDK v4.30.0 keeps navigation in renderer, fixing sign-in drops","path":"/release/rel_HAOJXoDVTTYdpBpZqCgaa-navigation-stays-in-renderer-no-more-sign-in-drops-from-virtual-routes","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.30.0","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_jhjZplhddZiOS8qpyanJJ","title":"Clerk Electron v0.0.36 keeps navigation in the renderer","path":"/release/rel_jhjZplhddZiOS8qpyanJJ-navigation-stays-in-renderer","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/electron%400.0.36","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_I3H4_l-XMXlNROr8Nx4yq","title":"Clerk JavaScript SDK 6.30.1 fixes premature verification timeout reporting","path":"/release/rel_I3H4_l-XMXlNROr8Nx4yq-verification-no-longer-reported-as-timed-out-mid-flow","url":"https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.30.1","org":{"slug":"clerk","name":"Clerk","avatarUrl":"https://media.releases.sh/orgs/clerk.png","githubHandle":"clerk"},"product":null,"importance":2},{"id":"rel_WPX5999CGTBlure2_PzAT","title":"WorkOS adds group management and roles in the Dashboard","path":"/release/rel_WPX5999CGTBlure2_PzAT-group-management-and-roles-now-in-the-dashboard","url":"https://workos.com/changelog/user-groups","org":{"slug":"workos","name":"WorkOS","avatarUrl":"https://media.releases.sh/orgs/workos.png","githubHandle":"workos"},"product":null,"importance":3},{"id":"rel_62ZdIoUSE6LTZ-5ITYVBJ","title":"WorkOS adds Waitlist API with self-serve setup for gating launches","path":"/release/rel_62ZdIoUSE6LTZ-5ITYVBJ-waitlist-api-gates-launches-agents-manage-entries-via-mcp","url":"https://workos.com/changelog/waitlist-api-and-self-serve-setup","org":{"slug":"workos","name":"WorkOS","avatarUrl":"https://media.releases.sh/orgs/workos.png","githubHandle":"workos"},"product":null,"importance":3},{"id":"rel_B8x6W-t0y19m_xo8ypy3a","title":"better-auth v1.7.2 clears stale ban expiration dates and hardens redirect validation","path":"/release/rel_B8x6W-t0y19m_xo8ypy3a-stale-ban-dates-cleared-redirect-validation-hardened","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.2","org":{"slug":"better-auth","name":"Better Auth","avatarUrl":"https://media.releases.sh/orgs/better-auth.png","githubHandle":"better-auth"},"product":null,"importance":2}]}]}}