SCIM is out of beta and open to everyone

Plus plan versions, roles for each org, and AI agents that ask before they connect

͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏
  ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏
  ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏
  ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏
  ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏
  ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏
  ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­͏   ­

https://www.kinde.com/




The offboarding problem

 
Someone leaves one of your customers on a Friday. IT removes them from Okta before lunch. Then nothing happens in your product,
because nobody told it, and that account keeps its permissions until someone remembers to file a ticket.
 
That’s not a people problem, it’s a plumbing problem, and this month we fixed most of it. Along the way we shipped a long list of
changes that put more control in your hands (and your customers’) instead of ours.




SCIM directory sync, now for everyone

 
Back in April we asked for beta testers. Now it’s live for every Kinde business: when your customer adds, updates, suspends or
removes someone in Entra ID, Okta or any other SCIM-compatible provider, Kinde updates that user for you. Joiners get access,
leavers lose it, and nobody has to remember anything.
 
Find the new Provisioning menu in each organization, with Directory and Logs pages showing exactly what came through. Each change
fires a user.updated webhook with the source scim, and a SCIM DELETE suspends rather than deletes, so returning users reattach to
the same Kinde account.




Plan versions you can actually see

 
Every time you publish a billing plan, Kinde saves it as a new version, and existing subscribers stay on theirs. Now you can see
every version with its subscriber count, pricing and publish date, roll back with Save as draft, and see which pricing tables a
publish will affect, so draft edits never reach your customers.




Cancel at the end of the billing period

 
Plans have a new Cancellation takes effect setting, so cancellations can apply immediately or at the end of the billing period.
Customers keep access until then and can hit Keep plan in the self-serve portal if they change their mind. Existing plans still
cancel immediately unless you change the setting.




Roles that belong to one organization (Scale plans)

 
Until now, roles were business-wide. A “billing approver” role created for one customer was visible and assignable in every
organization.
 
On Scale, each organization can now define its own roles and permissions, up to 100 per org, managed from the org’s Roles tab, the
Management API or the self-serve portal. Invalid role keys now return INVALID_ROLES instead of quietly disappearing.




Let users approve AI agents (available on request)

 
In July we gave your APIs a bouncer. Now your users get a say on who’s on the guest list: turn on Ask users to approve agents and
they’ll see a consent screen before Claude, ChatGPT or Cursor gets access. Approvals last 30 days, users and admins can revoke
them any time, and you can contact support to have it enabled.




Safer email trust for social and SSO connections

 
The “Trust email addresses” on/off switch is now three options: Don’t trust, Verify, then trust (merge only after a one-time code
confirms the email), and Trust.
 
That middle option means you can keep automatic account linking without the account-takeover risk of trusting a provider that
doesn’t verify emails. The new trust_mode option is in the Management API, and is_trusted is now deprecated.




Find out before your customers do

 
An expired Entra ID client secret. A SAML signing certificate about to lapse. An SMTP server rejecting sends after someone changed
a password. These are the kinds of things you usually hear about from an annoyed customer.
 
Kinde now shows a banner on your dashboard and status page when an enterprise SSO connection or custom email sender breaks,
including SAML certificates expiring within 30 days. The alerts clear automatically once it’s fixed.




Other 🔥 updates in October

 
 * One free trial per customer: Self-serve portal customers can only start one trial, while admin plan assignments aren’t
   restricted. POST /api/v1/billing/agreements gets a new optional skip_trial flag.

 * Change plans mid sign-up: A new “Select other plan” link on the payment page lets users go back and pick something different.

 * Clearer payment errors: Payment-step failures now show specific codes and messages, translated into all supported languages.

 * Self-serve portal members and invitations for everyone: Turn them on in Settings → Self-serve portal and Environment →
   Policies. Portal sessions now end after 10 minutes of inactivity, not 10 minutes after sign-in.

 * Cancellation workflows now receive the billing customer ID.




Security improvements

 
 * Wildcard callback, CORS and logout URLs now match literally, so look-alike domains are rejected

 * Create-account forms refuse existing usernames, closing an account takeover path

 * Password reset no longer reveals whether an email is registered when enumeration protection is on

 * Firewall fingerprint rules now protect custom domains as well as *.kinde.com




Minor fixes and improvements

 
 * Clear “link expired” pages for expired MFA, password, verification and passkey screens

 * Password managers now autofill on hosted sign-in pages

 * No more 10-a-month SMS cap on Pro, Plus and Scale, and Faroe Islands (+298) added

 * Partial connection PATCHes no longer reset stored options, and home realm discovery finds shared SSO connections again

 * Feature flags stay in sync with their overrides

 * Search, sort and paging on the webhooks list

 * Faster audit logs and user search on large tenants, and faster tokens in some regions

 * Fixed SCIM and API user deletion, and Cloudflare-proxied custom domains showing as churned




SDK updates

 * Management API JS - heads up: meter_value is now a number (breaking), plus new billing, directory and identity lookup endpoints

 * JWT Validator - fixes a 0.4.5 regression that broke Cloudflare Workers. If you’re on 0.4.5, upgrade.

 * iOS - invitation code support and a new prompt parameter for login

 * .NET - .NET 10 support

 * Fixes, dependency and tooling updates: Next.js, Expo, TanStack Router, Remix, JWT Decoder, Webhook, JS Utils, Terraform
   Provider

 
View the latest release notes [https://updates.kinde.com/announcements/scim-directory-sync-now-for-every-kinde-business] and
follow the roadmap [https://updates.kinde.com/board].




Customer spotlight


Glidepath Health

Glidepath Health [https://glidepathhealth.com/] is a New York medtech startup helping hospitals run their advanced therapy
programs. Their AI-driven platform plugs into critical hospital systems, including the EHR, so care teams get a single end-to-end
view across every program, from referral through infusion and beyond. In healthcare, identity and compliance aren’t something you
bolt on later, so Glidepath built on SOC 2-aligned foundations from day one.
 
Each customer org connects its own Entra ID or Okta tenant to Kinde, with roles mapped straight from IdP groups. With unlimited
enterprise connections, Glidepath can add new customer orgs without per-connection SSO costs piling up.
 






Join the Kinde community

 

Kinde on Slack [https://join.slack.com/t/thekindecommunity/shared_invite/zt-25gshkj52-AAn0R3V86WWsWkd8IH~~0g]

 

Kinde on Discord
[https://discord.com/invite/tw5ng5tK6V?_hsenc=p2ANqtz-_8KmIY8EWCE7UuQtZGMv9hpVx-epRYoOCSw23Z43YxqmL-VtEi6Rq1uBXbx9oc_lv-cGbT]

https://www.youtube.com/@heykinde/videos?_hsenc=p2ANqtz-_ZGn-giETK0nNIK_mEaVASiOCkxOK7h5IqkjWXYtx6zv63_vqJvjXh_fsqviTmBDMNo-4W

https://www.youtube.com/@heykinde/videos?_hsenc=p2ANqtz-_ZGn-giETK0nNIK_mEaVASiOCkxOK7h5IqkjWXYtx6zv63_vqJvjXh_fsqviTmBDMNo-4W

https://twitter.com/HeyKinde?_hsenc=p2ANqtz-_ZGn-giETK0nNIK_mEaVASiOCkxOK7h5IqkjWXYtx6zv63_vqJvjXh_fsqviTmBDMNo-4W

https://twitter.com/HeyKinde?_hsenc=p2ANqtz-_ZGn-giETK0nNIK_mEaVASiOCkxOK7h5IqkjWXYtx6zv63_vqJvjXh_fsqviTmBDMNo-4W

https://www.linkedin.com/company/heykinde/?_hsenc=p2ANqtz-_ZGn-giETK0nNIK_mEaVASiOCkxOK7h5IqkjWXYtx6zv63_vqJvjXh_fsqviTmBDMNo-4W

https://www.linkedin.com/company/heykinde/?_hsenc=p2ANqtz-_ZGn-giETK0nNIK_mEaVASiOCkxOK7h5IqkjWXYtx6zv63_vqJvjXh_fsqviTmBDMNo-4W

https://dev.to/kinde?_hsenc=p2ANqtz-_ZGn-giETK0nNIK_mEaVASiOCkxOK7h5IqkjWXYtx6zv63_vqJvjXh_fsqviTmBDMNo-4W

https://dev.to/kinde?_hsenc=p2ANqtz-_ZGn-giETK0nNIK_mEaVASiOCkxOK7h5IqkjWXYtx6zv63_vqJvjXh_fsqviTmBDMNo-4W

 


Learn more about Kinde

Schedule a demo [https://www.kinde.com/intro-to-kinde/]

 

Visit the website [https://kinde.com/?_hsenc=p2ANqtz-_8KmIY8EWCE7UuQtZGMv9hpVx-epRYoOCSw23Z43YxqmL-VtEi6Rq1uBXbx9oc_lv-cGbT]

 
 
You are receiving this email because you opted in to receive email from the list Bits & Bytes newsletter from Kinde
Kinde, 26/368 Sussex Street, SYDNEY, NSW 2000
Unsubscribe [https://app.loops.so/unsubscribe/cmvvlr14g5xif01zjb9iicqsj/907d8f5fb36b8f15398184f3e53009d6c3f0567e2ea66e06bd01139b1bbef3b83b2f0835c5ba898ac96eb794dc6b2b039c920e21d9b31344921b2aae]

Accession

nse/kinde/2026-10-30/5721

From

Kinde Bits and Bytes · marketing@newsletter.kinde.com

Sent

30 October 2026 · 23:00 UTC