Changelog

2.189.0 (2026-04-23)

Features

• add PKCE support for /resend (#2401) (2af904a)
• improve parallelization in github workflows and Makefile (#2436) (9d0c4b3)
• passkeys: add CAPTCHA to options endpoint for authentication (#2416) (c7b58be)
• support live reloading of individual rate limits (#2469) (d03d796)

Bug Fixes

• ensure identities are returned in a consistent order across DB engines (#2465) (e49a3e5)
• ensure SSO providers tests are order-independent (#2466) (983ade6)
• exempt PKCE recovery sessions from require-current-password check (#2502) (7f88985)
• indexworker: skip index creation on OrioleDB (#2481) (dd56ae9)
• passkeys: modify the passkeys request and response shapes (#2475) (2d8f2b6)
• prevent reuse of flow state (#2483) (88dcb2d)
• return JSON response for unmatched routes instead of plain text (#2457) (7337e21)

2.188.1 (2026-03-19)

Bug Fixes

• remove make all from release workflow (#2433) (036e723)

2.188.0 (2026-03-17)

Features

• cache OIDC discovery documents for providers (#2389) (40d07b5)
• enable custom providers by default (#2427) (291cdad)
• modernize IsNotFoundError handler to support errors.Is (#2392) (ab7c9f9)
• oauth-server: allow updating token_endpoint_auth_method for OAuth clients (#2391) (1280dc1)
• passkeys: add admin endpoints to list and delete passkeys (f109550)
• passkeys: add audit, metering, webauthn primitives (039b569)
• passkeys: add configuration, error codes, and schemas (0a5eb95)
• passkeys: add discoverable credential auth flow (#2411) (1bc68ea)
• passkeys: add management endpoints (#2413) (5b3218e)
• passkeys: add rate limiter on the /options endpoint for authentication (#2422) ()

Bug Fixes

• add MaxBytesReader middleware to limit request body size to 1MB (#2402) (6f0b2eb)
• bump Go to v1.25.8 (#2412) (a2e357f)
• passkeys: construct configuration env var correctly (dba676e)
• passkeys: enforce passkey cap during registration verify (9868df6)
• passkeys: return 204 when deleting a passkey (7d90fb8)
• passkeys: sign_count should be uint32 (e509e3a)

2.187.0 (2026-02-23)

Features

• add metadata field to all hooks (#2365) (c675749)
• check current password on change (#2364) (33b87ae)
• indexworker: add max users threshold for rollout (#2374) (a2066c6)
• metrics: added a gauge with version information (#2375) (911ad0b)
• support custom oauth & oidc providers (#2357) (53021f6)

Bug Fixes

• case-insensitive Bearer token scheme matching (#2387) (36d712d)
• correctly parse JWT ValidMethods from env by enabling split_words (#2334) (a6076bc)
• flaky index worker test (#2366) (961a7e6)
• hooks: propagate error objects from hook calls (#2380) (3ca1e88)
• session upgrade percentage should be based on session, not request (#2371) (510e68b)

2.186.0 (2026-01-28)

Features

• Add email send operation metrics (#2311) (0096575)
• add Supabase Auth identifier to OAuth redirect URLs (#2299) (2d3dbc6)
• log sb-auth-user-id, sb-auth-session-id, ... on sign in not just refresh token (#2342) (a486ada)
• oauth-server: store and enforce token_endpoint_auth_method (#2300) (bcd6cd5)
• replace JWT OAuth state with flow_state.id UUID (#2331) (645654d)
• upgrade existing sessions to v2 refresh tokens though config value (#2356) (6fb0e8a)

Bug Fixes

• reloader unittest races on writeWg (#2352) (088b714)
• update migration version (#2343) (61ef4db)

2.185.0 (2026-01-12)

Features

• Add Sb-Forwarded-For header and IP-based rate limiting (#2295) (e8f679b)
• allow amr claim to be array of strings or objects (#2274) (607da43)
• reset main branch to 2.185.0 (#2325) (b9d0500)
• Treat rate limit header value as comma-separated list (#2282) (5f2e279)

Bug Fixes

• additional provider and issuer checks (#2326) (cb79a74)
• check each type independently (#2290) (d9de0af)
• fix the wrong error return value (#1950) (e2dfb5d)
• indexworker: remove pg_trgm extension (#2301) (c553b10)
• oauth-server: allow custom URI schemes in client redirect URIs (#2298) (ea72f57)
• tighten email validation rules (#2304) (33bb372)

2.184.0 (2025-12-08)

Features

• increment refresh token counter by 2 for mfa verify (#2284) (2a38668)
• load template cache at startup for fault tolerance (#2261) (511c3a4)
• oauth: add support for X/Twitter v2 provider (#2275) (7f36eb0)

2.183.0 (2025-11-20)

Features

• async, concurrent index creation for users table (#2239) (a1146bf)
• indexworker: use auth_trgm extension if available (#2263) (05daa43)
• oauthserver: add OpenID Connect support (#2250) (162788f)
• oauthserver: update oauth grant list & authorization details response structure (#2247) (137ea92)
• oauthserver: use NewOAuthServerAuthorizationParams & configurable ttl for authorization (#2254) (61632f8)

Bug Fixes

• indexworker: detect which schema pg_trgm exists in (#2260) (4be12b3)
• look for refresh token on mfa verification only in v1 (#2249) (2906b24)
• mfa verify now works with refresh token algorithm v2 (#2246) (4e8275f)
• social-auth: default to current_user:read for Figma provider (#2195) (f409d11)

2.182.1 (2025-11-05)

Bug Fixes

• japanese dot example fix (#2243) (3a5f4b2)

2.182.0 (2025-11-05)

Features

• oauthserver: add authorization list and revoke endpoints (#2232) (cc640b2)

Bug Fixes

• hostname can be empty with redirect urls (#2241) (f5a4cba)

2.181.0 (2025-10-31)

Features

• add .well-known/openid-configuration (#2197) (9a8d0df)
• add auth_migration annotation for the migrations (#2234) (b276d0b)
• add advisor to notify you when to double the max connection pool (#2167) (a72f5d9)
• add after-user-created hook (#2169) (bd80df8)
• add support for account changes notifications in email send hook (#2192) (6b382ae)
• email address changed notification (#2181) (047f851)
• identity linked/unlinked notifications (#2185) (7d46936)
• introduce v2 refresh token algorithm (#2216) (dea5b8e)
• MFA factor enrollment notifications (#2183) (53db712)
• notify users when their phone number has changed () ()

Bug Fixes

• gosec incorrectly warns about accessing signature[64] (#2222) (bca6626)
• openapi: add missing OAuth client registration fields (#2227) (cf39a8a)

2.180.0 (2025-09-23)

Features

• add OAuth client type (#2152) (b118f1f)
• add phone to sms webhook payload (#2160) (d475ac1)
• background template reloading p1 - baseline decomposition (#2148) (746c937)
• config reloading with fsnotify, poller fallback, and signals (#2161) (c77d512)
• enhance issuer URL validation in OAuth server metadata (#2164) (a9424d2)
• implement OAuth2 authorization endpoint (#2107) (5318552)
• oauth2: add /oauth/token endpoint (#2159) (a89a0b0)
• oauth2: add admin endpoint to regenerate OAuth client secrets (#2170) (0bd1c28)
• oauth2: return redirect_uri on GET authorization (#2175) (b0a0c3e)

Bug Fixes

• ensure request context exists in API db operations (#2171) (060a992)
• makefile: remove invalid @ symbol from shell commands (#2168) (e6afe45)
• oauth2: switch to Origin header for request validation (#2174) (42bc9ab)

2.179.0 (2025-08-28)

Features

• add oauth2 client support (#2098) (8fae015)
• experimental own linking domains per provider (#2119) (747bf3b)
• fetch email from snapchat oauth provider if available for consistency (#2110) (7507822)
• implement link identity with oidc / native sign in (#2108) (5f0ec87)
• implements email-less accounts with oauth (#2105) (9a61dae)
• introduce request-scoped background tasks & async mail sending (#2126) (2c8ea61)
• refactor mailer client wiring and add validation wrapper (#2130) (68c40a6)
• support multiple aud for the external providers (#2117) (ca5792e)
• use slices.Contains instead of for loops (#2111) (9f22682)

Bug Fixes

• add id-token permission to ci (#2143) (79209c0)
• add missing param (#2125) (c0b75f6)
• change s3 artifact upload role (#2145) (767e371)
• remove requirement of empty content-type on 204 (#2128) (ecc97e0)
• run release-please again (#2144) (2560f14)
• stripped binary now includes version (#2147) (609f169)
• update copyright year in LICENSE (#2142) (67fe0b0)

2.178.0 (2025-08-05)

Features

• add sign in with ethereum (#2069) (079b242)
• add support for managing SSO providers by resource_id (#2081) (5ca4489)
• log all audit events separately to prevent missing events (#2086) (3b666f5)
• skip nonce check for Facebook Limited Login auth (#2082) (f1b15ff)
• support ledger solana offchain message signing (#2093) (4c94443)

2.177.0 (2025-07-05)

Features

• add option to disable writing to audit_log_entries (#2073) (80758dd)
• add snapchat provider (#2071) (fca8ea4)
• enhance login analytics (#2078) (1aed4a2)
• fallback to jwt secret if alg is HS256 and the kid is not recognized (#2072) (8fa99bd)
• ignore aud claim from admin jwt (service_role never had one) (#2070) (57eddcb)

Bug Fixes

• add missing provider info to signedup audit logs (#2061) (c6e0cbe)
• auditlog: keep writing to logs even postgres is disabled (#2076) (b89bc32)
• do not log fatal when http server successfully closes (#2065) (1f7de6c)
• invites should send another email when user exists (#2058) (96469bd)
• use appleid.apple.com as default issuer (#2068) (963a781)
• use split_words config option for AuditLog (#2075) (7ecb234)

2.176.1 (2025-06-11)

Bug Fixes

• new odic.Provider for apple with insecure issuer url context (#2055) (23d69f1)
• skip apple oidc issuer check (#2053) (1c6f18e)

2.176.0 (2025-06-11)

Features

• Add custom claims from Keycloak user token (#1917) (1365aaa)

Bug Fixes

• accept ID tokens from all account.apple.com and appleid.apple.com (#2050) (82aa167)

2.175.0 (2025-06-03)

Features

• hooks round 5 (Option 2) - add before-user-created hook (#2034) (b53f6b0)

Bug Fixes

• email-sendhook - bug in email change verification (#2044) (be20654)

2.174.0 (2025-05-23)

Features

• hooks round 2 - remove indirection and simplify error handling (#2025) (26e23f0)
• hooks round 4 - update tests to use require package (#2030) (aaf93df)

Bug Fixes

• amr claim should contain provider_id for sso method (#2033) (33741e1)

2.173.0 (2025-05-17)

Features

• add support packages for end-to-end testing (#2021) (269ddfe)

Bug Fixes

• add supafast tarball for upgrading auth via supabase-admin-api (#2009) (9b55785)
• allow HTTP with localhost in solana (#2027) (3ee02f0)
• fix supafast tarball generation (#2011) (88bb2c0)

2.172.1 (2025-05-05)

Bug Fixes

• use redirect URL as-is for mobile apps (#2007) (b36cdcd)

2.172.0 (2025-05-04)

Features

• fix large group claim handling in azure id tokens (#1995) (2f323fe)
• use global_user_id over sub for vercel_marketplace issuer (#1990) (f94f97e)

Bug Fixes

• azure overage claims start with single _ not two (#1999) (29f3440)
• remove azure claim overage code. (#2005) (63dce14)
• resolving azure overage claim should include api-version=1.6 query parameter (#2000) (44890d0)
• upgrade godotenv to v1.5.1 to fix multiline file loading (#1997) (f2af4b2)

2.171.0 (2025-04-14)

Features

• add sign in with solana (EIP-4361) support (#1918) (d121546)
• allow invalid config directories (#1969) (6b842f6)
• allow limiting lifespan of low-aal sessions (#1942) (d7a9ca6)
• Block specific outgoing mail servers (#1971) (091aef9)
• refactor hooks out of api package (#1976) (c5904c0)
• separate web3 rate limits from other /token?grant_type=... (#1985) (8b23382)

Bug Fixes

• explicit permisions on actions (#1978) (06e9ead)
• propagate error when when confirming phone (#1939) (e882b42)
• redirects must not be to ip addresses (#1984) (347e23a)
• sanitize redirect URL (remove fragment, query) before pattern matching (#1974) (ccf20d7)

2.170.0 (2025-03-06)

Features

• improvements to config reloader, 100% coverage (#1933) (21c2256)
• increase test coverage in conf package to 100% (#1937) (bc57c1c)

Bug Fixes

• enable SO_REUSEPORT in listener config (#1936) (a474b80)
• ignore not found error to check for pkce prefix later (#1929) (fbbebcc)
• log version & migration count (#1934) (8078cdc)
• update figma token endpoint (#1952) (18fbbb5)
• use sys/unix instead of syscall (#1953) (4a6d9bc)

2.169.0 (2025-01-27)

Features

• add an optional burstable rate limiter (#1924) (1f06f58)
• cover 100% of crypto with tests (#1892) (174198e)

Bug Fixes

• convert refreshed_at to UTC before updating (#1916) (a4c692f)
• correct casing of API key authentication in openapi.yaml (0cfd177)
• improve invalid channel error message returned (#1908) (f72f0ee)
• improve saml assertion logging (#1915) (d6030cc)

2.168.0 (2025-01-06)

Features

• set email_verified to true on all identities with the verified email (#1902) (307892f)

2.167.0 (2024-12-24)

Features

• fix argon2 parsing and comparison (#1887) (9dbe6ef)

2.166.0 (2024-12-23)

Features

• switch to googleapis/release-please-action, bump to 2.166.0 (#1883) (11a312f)