https://developer.authreads.com/changelogIntegrator-visible changes to the Authreads API: additions, behaviour changes and fixes, with the environments that have them.en-usTue, 27 Oct 2026 00:00:00 GMThttps://developer.authreads.com/changelog#2026-10-27-shared-browser-trust-and-clearer-email-deliveryhttps://developer.authreads.com/changelog#2026-10-27-shared-browser-trust-and-clearer-email-deliveryTue, 27 Oct 2026 00:00:00 GMTDevelopment changes for the coordinated 6.2–6.6 batch release. Added: Remember several people on one browser (Development). Added: See delivery evidence for a user or operator (Development). Fixed: Choose usable recovery proof before sending an unnecessary setup email (Development).https://developer.authreads.com/changelog#2026-10-27-independent-email-delivery-trackinghttps://developer.authreads.com/changelog#2026-10-27-independent-email-delivery-trackingTue, 27 Oct 2026 00:00:00 GMTEmail delivery status stays available when optional tenant sender settings are incomplete. Fixed: Platform delivery tracking is independent of tenant sender readiness (Development).https://developer.authreads.com/changelog#2026-10-26-consistent-sign-in-proof-session-and-device-trust-ruleshttps://developer.authreads.com/changelog#2026-10-26-consistent-sign-in-proof-session-and-device-trust-rulesMon, 26 Oct 2026 00:00:00 GMTDevelopment changes for the coordinated 6.2–6.4 batch release. Changed: Invalid reverify sessions have one terminal response (Development). Fixed: Setup respects the account-wide strongest factor (Development). Fixed: Hosted trust uses the same current server decision as API sign-in (Development).https://developer.authreads.com/changelog#2026-10-25-self-service-factors-and-v2-only-api-sign-inhttps://developer.authreads.com/changelog#2026-10-25-self-service-factors-and-v2-only-api-sign-inSun, 25 Oct 2026 00:00:00 GMTBackend-owned sign-in can manage the user's own strong factors with shared fresh-proof rules. Added: App-bound factor management and one-time recovery codes (Development). Changed: Removed legacy email login, old session reverify and legacy invite mutation (Development). Fixed: Typed app mismatch and actionable trusted-device fields (Development).https://developer.authreads.com/changelog#2026-10-22-oauth-interoperability-and-legacy-sign-in-protectionhttps://developer.authreads.com/changelog#2026-10-22-oauth-interoperability-and-legacy-sign-in-protectionThu, 22 Oct 2026 00:00:00 GMTAvailable in development; production rollout requires operator configuration and migration review. Added: Public tenant IDs in signed installation payloads (Development). Changed: Policy protection and migration signals for legacy email-code login (Development). Fixed: Standard Basic client authentication on the token endpoint (Development).https://developer.authreads.com/changelog#2026-10-21-generally-available-in-productionhttps://developer.authreads.com/changelog#2026-10-21-generally-available-in-productionWed, 21 Oct 2026 00:00:00 GMTProduction now runs everything on this page. Every earlier entry is available on the production base URL, and passkeys, authenticator apps, recovery codes and sign-in strength are generally available. Added: Passkeys, authenticator apps and recovery codes for end users (All environments). Added: Requested sign-in strength and step-up (All environments). Changed: Earlier entries are now in production (All environments).https://developer.authreads.com/changelog#2026-10-09-hosted-passkey-sign-in-and-verified-authentication-claimshttps://developer.authreads.com/changelog#2026-10-09-hosted-passkey-sign-in-and-verified-authentication-claimsFri, 09 Oct 2026 00:00:00 GMTOrganisation-enabled passkeys can complete hosted sign-in on the exact login site where they were added. Changed: User-verified passkeys include pop and mfa (All environments).https://developer.authreads.com/changelog#2026-09-28-management-rename-requests-reject-unsupported-fieldshttps://developer.authreads.com/changelog#2026-09-28-management-rename-requests-reject-unsupported-fieldsMon, 28 Sep 2026 00:00:00 GMTRole and package rename requests now report an invalid request when a caller supplies fields the operation cannot change. Changed: Unknown fields in role and package PATCH bodies receive 422 (All environments). Fixed: Step-up retains a session's original authentication method (All environments).https://developer.authreads.com/changelog#2026-09-25-machine-ownership-and-per-person-admissionhttps://developer.authreads.com/changelog#2026-09-25-machine-ownership-and-per-person-admissionFri, 25 Sep 2026 00:00:00 GMTTenant automation can assign a machine owner and enforce an audited active-machine limit per person. Added: Machine ownership and tenant-managed person limits (All environments).https://developer.authreads.com/changelog#2026-09-16-verifiable-enrolment-and-machine-revocation-deliveryhttps://developer.authreads.com/changelog#2026-09-16-verifiable-enrolment-and-machine-revocation-deliveryWed, 16 Sep 2026 00:00:00 GMTMachine enrolment now produces proof a customer's backend can verify, and a configured customer endpoint can receive durable signed revocation events. Added: Enrolment redemption returns a signed, key-bound receipt (All environments). Added: Signed installation-revocation notifications (All environments). Fixed: A stale out-of-range policy field no longer hides the entire policy (All environments).https://developer.authreads.com/changelog#2026-09-15-complete-machine-lifecycle-automationhttps://developer.authreads.com/changelog#2026-09-15-complete-machine-lifecycle-automationTue, 15 Sep 2026 00:00:00 GMTTenant backends can now issue bounded machine tickets and retire individual installations through the public Management API. Added: Issue one-use machine enrolment tickets (All environments). Added: Retire one machine installation (All environments).https://developer.authreads.com/changelog#2026-09-07-consent-bound-attribution-is-reachablehttps://developer.authreads.com/changelog#2026-09-07-consent-bound-attribution-is-reachableMon, 07 Sep 2026 00:00:00 GMTPeople can bind external identities, manage disclosure consent, and request erasure through the published account API and hosted surfaces. Added: Attribution binding, consent, withdrawal, and erasure API (All environments).https://developer.authreads.com/changelog#2026-08-12-bounded-fleet-enrolment-and-phase-4-write-errorshttps://developer.authreads.com/changelog#2026-08-12-bounded-fleet-enrolment-and-phase-4-write-errorsWed, 12 Aug 2026 00:00:00 GMTFleet enrolment now rejects database conflicts with stable codes, preserves retry accounting, and applies pre-database abuse controls plus operator-bounded tenant capacity. Changed: Anonymous redemption and installation capacity are genuinely bounded (All environments). Fixed: Phase 4 constraint failures now have actionable codes (All environments).https://developer.authreads.com/changelog#2026-08-12-machine-readable-login-failures-and-consistent-native-logouthttps://developer.authreads.com/changelog#2026-08-12-machine-readable-login-failures-and-consistent-native-logoutWed, 12 Aug 2026 00:00:00 GMTDirect and hosted login now share stable actionable codes, and native apps can use the same loopback redirect policy when signing out as when signing in. Added: Local back-channel logout development guidance (All environments). Changed: Credential and rate-limit responses now emit stable codes (All environments). Fixed: Post-logout loopback redirects match authorization redirects (All environments). Fixed: Trusted-device alerts are branded and now name the device, time, and a way to act (All environments). Fixed: Set-password emails name the right sender, reason, and expiry (All environments).https://developer.authreads.com/changelog#2026-08-11-reliable-oidc-session-terminationhttps://developer.authreads.com/changelog#2026-08-11-reliable-oidc-session-terminationTue, 11 Aug 2026 00:00:00 GMTRelying parties can now receive a signed, durable notification when an Authreads OIDC session is revoked or reaches its absolute expiry. Added: OpenID Connect Back-Channel Logout 1.0 (All environments). Changed: Hosted lockouts include a stable extension code (All environments). Fixed: Idle-timeout scope is documented explicitly (All environments).https://developer.authreads.com/changelog#2026-08-11-live-policy-inheritance-and-honest-login-errorshttps://developer.authreads.com/changelog#2026-08-11-live-policy-inheritance-and-honest-login-errorsTue, 11 Aug 2026 00:00:00 GMTA tenant's security policy now actually inherits platform-default changes, and a locked-out login is no longer indistinguishable from an expired OAuth grant. Fixed: Tenant security policy inherits platform-default changes again (All environments). Fixed: Login failures return honest, distinguishable errors (All environments). Fixed: New-trusted-device notification email now actually sends (All environments).https://developer.authreads.com/changelog#2026-08-11-account-security-for-tenant-backendshttps://developer.authreads.com/changelog#2026-08-11-account-security-for-tenant-backendsTue, 11 Aug 2026 00:00:00 GMTSelf-service session and trusted-device management became reachable from a tenant's own backend, not only from our hosted login pages. Added: Seven account-security endpoints on the tenant BFF surface (All environments). Added: account-security:read and account-security:manage scopes (All environments). Added: Per-tenant control of the new trusted-device email (All environments). Added: Trusted devices on the hosted login (All environments). Added: Session idle timeout (All environments). Changed: Session exchange returns session policy and activity state (All environments). Changed: RP-initiated logout no longer requires id_token_hint (All environments). Fixed: Logout could leave the single-sign-on cookie alive (All environments).