22 July 2026

Production release: 22 July 2026
Staging release: 20 July 2026

20 July 2026

API Product Scopes : OAuth authorize and token endpoints now resolve and attach API product scopes when the API product feature is enabled. API product scope is optional when creating a product, with more flexible scope and name validation.
On-Behalf-Of Subject Delegation : Added optional support for subject-delegation tokens in the on-behalf-of (OBO) flow, controlled by new configuration flags and disabled by default.
TLS Enforcement : Added TLS enforcement configuration across all regions.
Default Account Fallback : When no default account is set, the system now falls back to the user’s first account and records it as the default.
Dark Mode & Partner Logos : Auth screens now support application logos in dark mode with improved partner logo rendering, along with refined spacing on region helper text for TID-v2.
Rotated mTLS certificates and updated the truststore as part of annual maintenance activity.

Fixed production errors caused by MFA session settings being stored in the wrong format; the MFA type is now stored correctly, and passkey and backup-code sign-in flows work without requiring additional settings.
Fixed identity-provider handling with added name validation and more robust federation redirect resolution and error handling.
Fixed crashes caused by null or invalid IP addresses during metrics processing.
Fixed data type mismatches in OAuth and user metrics processing.
Fixed profile resync behavior.
Removed an unnecessary email update during v4 user migration.
Fixed a username alias issue in the enforced-MFA flow.
WebAuthn credentials that can no longer be decoded are now automatically removed to prevent repeated sign-in failures.
Improved error logging and validation in the Identities API for application creation and SAML.