Logto product updates
Logto product updates
- Product
- Logto
- Sent from
- logto.io
- Sent
No dark-mode styles — this email renders the same in a dark client.
Logto product updates 🚀 OIDC step-up authentication, Sign-In with Ethereum, the iOS Save Password prompt, and self-service personal access tokens. Hi b-logto-2i0b45, Logto v1.46.0 is out, bringing OIDC step-up authentication, Sign-In with Ethereum, a way to keep the iOS Save Password prompt, and self-service personal access tokens, along with GeeTest CAPTCHA, SAML static attributes, and a round of security hardening. Here's what's new. OIDC step-up authentication --------------------------- Apps can now require a recent or stronger sign-in before sensitive actions, using standard OIDC parameters. * Pass acr_values and max_age in the authorization request, then read acr , amr , and auth_time from ID tokens, access tokens, and introspection responses. * Account Center now authorizes sensitive Account API operations with a fresh first-party access token. When the sign-in isn't recent enough, the Account API answers with an RFC 9470 step-up challenge. * Set how recent the sign-in must be under *Console > Sign-in experience > Account center > Recent authentication* (10 minutes by default). * Apps that call the Account API directly can keep using a verification record ID for sensitive operations. Sign-In with Ethereum --------------------- The new Ethereum Wallet social connector lets users sign in with an EVM wallet. Users with a browser wallet sign a one-time Sign-In with Ethereum (EIP-4361) message without leaving the sign-in page. One address works across supported EVM chains, and admins can restrict the allowed chain IDs. Keep the iOS Save Password prompt --------------------------------- On iOS, ASWebAuthenticationSession closes as soon as it sees the app's callback URL, which dismisses the system "Save Password" prompt right after a password sign-in. Pass the new confirm_redirect_policy=password sign-in parameter to show a "Continue" page after the user enters a password. The page returns to the app only when the user selects "Continue", so the prompt stays on screen. The Swift integration guide in Console shows how to use it. Self-service personal access tokens ----------------------------------- When personal access tokens are turned on in Account Center, users can create, rename, and revoke their own tokens on the Account Center *Security* page. Each token is shown only once at creation and expires within 365 days. The same operations are available through the Account API with the new urn:logto:scope:personal_access_tokens scope. More sign-in and admin controls ------------------------------- * *GeeTest CAPTCHA:* GeeTest CAPTCHA v4 is now available under *Console > Security > CAPTCHA* , a good fit for sign-in experiences targeting mainland China. * *Require MFA setup for a user:* Turn it on from the user details page or with mfa.required in the Management API. The user must set up MFA on their next sign-in. * *Unlock a user:* Clear all sign-in and security verification lockouts for a user from the user details page. * *SHA-crypt password import:* Migrate users with $5$ and $6$ password hashes using the Legacy password algorithm. * *SAML static attributes:* Send fixed values, such as an account or site ID, in every SAML assertion. * *Cross-Origin-Opener-Policy for Bring your UI:* Choose same-origin-allow-popups or same-origin for hosted sign-in pages that serve your custom UI. * *access_denied when sign-in is cancelled:* Cancelling the consent page, or a failed direct sign-in, now returns the user to the app with access_denied. * *login_hint for Account Center:* Pre-fill the identifier when users need to sign in to Account Center. Management API and webhooks --------------------------- * Search users by custom data with the repeatable customData query parameter on GET /api/users. * Find the organizations a user would be provisioned into with the jitEmailDomain query parameter on GET /api/organizations. * GET /api/organizations/:id/users now shows whether each member has a password set. * Every webhook payload now carries a deliveryId that stays the same across retries, so receivers can process each delivery exactly once. Security hardening ------------------ This release includes security fixes across MFA, social and enterprise sign-in, the Account API, and Logto Tunnel. * *Action required:* the standard OAuth 2.0 social connector adds a *Disable Email Sync* switch, matching the Microsoft Azure AD connector. Upgrading alone does not change how existing connectors behave, so review every OAuth 2.0 and Azure AD social connector and turn the switch on when the provider does not verify that users own the email addresses it returns. * The Apple connector now takes the user's email only from the Apple ID token, and returns no email when Apple marks it as unverified. * User-level and organization-level MFA requirements now take precedence over account settings that turn MFA off or skip it, and MFA verifications are bound to the account they were created for. * SAML enterprise SSO connectors now accept an assertion only when its audience exactly matches the connector's Audience URI (SP Entity ID). * Retrieving stored social or enterprise SSO provider tokens, and reading backup codes, sessions, grants, and trusted devices through the Account API, now require a first-party application. * Authorization codes, device codes, pushed authorization requests, and one-time tokens are now strictly single-use. Other improvements and fixes ---------------------------- * The sign-in page no longer loads blank on iOS and Safari versions earlier than 16.4. * Social sign-in errors are clearer: an unreachable provider returns a 502, a declined authorization returns a 401 with the provider's error, and connector errors show the provider's actual message. * Refresh token requests from clients such as OpenAI Codex that send a space-padded scope no longer fail with invalid_scope , so users stay signed in. * Creating or updating an application now rejects unknown customClientMetadata keys, so typos no longer pass silently. * The Patreon connector moves to Patreon API v2, so Patreon sign-in works again. * The Swift integration guide now uses a consistent client name in its code examples. Self-hosting notes ------------------ * The official Docker image now runs on Node.js 26. Logto supports Node.js 22, 24, and 26, with minimum versions 22.23.4, 24.22.1, and 26.12.1. * This release ships database alterations. Run the database alteration command before starting the new version. * Core and the CLI database commands now retry the database connection on DNS failures instead of exiting immediately. Thanks to community contributors @nicolaj0 ( https://github.com/nicolaj0 ) , @RaphaelFakhri ( https://github.com/RaphaelFakhri ) , @mvanhorn ( https://github.com/mvanhorn ) , and @timokoethe ( https://github.com/timokoethe ) for their work in this release. Try these new features now ( https://cloud.logto.io/?utm_source=email&utm_medium=product-update ) As always, we welcome your feedback and suggestions. Feel free to reach out if you have any questions or need assistance. Logto ( https://logto.io/?utm_source=email_footer&utm_medium=email&utm_content=footer_brand_link ) : The better auth and identity infrastructure. ( https://discord.gg/TYN6pbRqvp ) ( https://github.com/logto-io ) ( https://twitter.com/logto_io ) ( contact@logto.io ) © Silverhand, Inc., 2810 North Church Street, Wilmington, DE 19802 Unsubscribe ( https://url6610.logto.io/asm/unsubscribe/?user_id=33014903&data=r3pPUj7RV-u5r359lcadBa_AtjMhu4ongAGcxZR1lSZoMDAwdTAwMGQyqYkJXa0DSQa5do3jvt1LqTKSZAVOeHxP0iY6lATa1V5XpeeYwyAcL2mHi66IFqRwEU5Y0ibmqEZqVxgnDIF6NQthtJGdM22x1x4JI28QPsFBn8PwxSQaOG-HFQDHJ1p8Xr_f61kcB0FDCf4gUh_FR5-pCJLJFFkCjKpdyjDxXUUhaROTaBDDSW3vG6_F5fYAI58tmxThAIMKl8g0-8_bO99-lhED8X2tULgC3wxsbKf758uQQUDE2i7iZSpPZovbofy8h7AqLoOKJsIdGXP5p47EIG-vQyc49zdecovTPud3h41lRxSzDXOpn9JyIz42fiexUcamo9WAcFZoPzLa1OtKl5LQTzO1R05yh_ExVu2mvy-4pWu_KxwPeOcRsJtl7JLRBSZ31I372Mkik8R28WqJ_Msl-se81lc5kp8rCMbcSBCNi6WbGU5EXaD9VY28kvSJqc66ZMgvEgXi0ZGcCJ_ilFEf7AqYjhgGvzrE1M0eyb8GybFtx6ATdZJu4w6FxhLC5jekYNsHbQIsKQfE3R-DM2eGA08FQrPU7qjFrv7VgVxA5EkCKyFTpdlOkq8qYKIf-xPz6PkhVPdWoGxKgyKhLO3ptJCjVyBDewem7ALzewDKBwfxE_C1qVSo3OezWHQl9cpDdiHqDudnOsNN8C9dXdPkwe9qDMmHc8Uyb4b3gwW5e_UvCVDGvl2ksLlwNdpm5O9RNU3QiSm4-ud8QWvVqkMIxnL6x-8IWYl7MT8wETPLWJ1M__xfUeX_m7BA0woJr0LJFbWhhBG-k4Olqok-SkQm1U7pnj-PDFPDe-wA9UMG7QTVaJj0Vzn_JtPXFyYd4T2-xO5ApZl-QyPPj6RfjdR3qc7C9OTePQiXGnVGbL2cDkeGK5kcFbq4_SGwqonUIfarbRqlcnr_BngKYEf4p7tBrXTNCkUVyYUxothANVV4oFqIg0zc87kHqiUdI5gTtgMW1HufuNKFG5fy0edkUc6N87Hg06cs_s9V083je2xke-CqMI6GMUaq5OcNLrJ957ILeH15G5_kjkHPkNuMA8mV95fm05EdP7J4oolhTEvpQC66E_tKyf2sf3x3jf1Fz3YTptcz9xJn5m4= ) - Manage subscriptions ( https://url6610.logto.io/asm/?user_id=33014903&data=rWRVzq7eM-oFofEgUcZFXlR9ESPmOnptDPAtM7fpkHxoMDAwdTAwMNhMV3wgxM7SWImexy2lTaIQpexKVsWAg_SDP8GTMGysgDKFfrwdMDsBpnByHcMRHdGy-U-bicU-rnoCUxrdl6qMN50lVA0estq2kBDiYYMsjiBRAL12AuzI1h9Yy8jI1J0VWwYXdQLzOtudQRpjfzE2LTe7Ez4nJiuEBlbZA5saE6z2EP0Ttfl1Cp-odPfAabeDlEamzIj4io6r5qtodIyUg6-sYgSyqpSoI7w0dMpbsHQ6eIoVd2Y15bXUjVRlDi7IStbbMCO0dTqHeLZLGQutyWw_b9bWy0T5kPgN4Ir1_5lAE51AjBs0PJLx0M7zGYzKxu1-IE8N82XbMpMrSHzd9rPHYEmE6xj4LYduExkyx8S3Jkdky0adctAh-Q29LmQUZpJ3kCsFc9w0TZEJPyLprRjv5SloE7VaXtptfxv8xKZxTPGbh6hnrXck0b4RnsbzvKz0Igw8B5HP1zRqXOk1-LMbpSuIcIfNQMWynubeEP4zOEv_SgbuEAqfc75Wm8hHObMBi-diIrlEeUqkMF1K_YjQPLR-tWafw6Y3KTPWjXlcnd045kTshEiTb-qZeEA4q8gBoBLRjz5vVaSZPOToY_QSRONs4CD0ojnuCikpwOGxV4wMPkPxA6tNRpYr9fLHjhIle_zEsAWaKy5RQ0S2f90rAjyM4tBgFvp2MgQzB1ETh5rAQrqgtUHzGNc_3hoB5j2wFnE-LAzBlaC8Pv1Y3h60hDN50PBauZvLAZhxK4ARROmxESAFTt9sDDK6RgaekaPxGje-GGAe1C5n9FtMCEauViixS1fQ-wgpOThGURsdCypJjN4WWK-SEGeg7NF072mOabjaz7Sj9ZCfai98otCLz7fVa-BeU2igBcItOqqRSY7qugWTeXERUC3Xv2w_aVWldIJblMHPHngBZv8fOEJ0ef7XszbBVd_QLqCPmzc0U7Ffs2bWNClEB8ucxsFFC4Y5N49QTEO5zNnnvjNJVtq9Rg-EY8rZUAPmrl7wilC3j_NHXGpB6omzacpJiz6xsO4HQKOcoQ-W4EbXZqMCfgTuSV0OvCl1JoT5xbTgSnZZdHtFCv6ymnR3q3JUiQ== )
- Accession
- nse/logto/2026-11-06/6276
- From
- Logto Community · community@logto.io
- Sent
- 6 November 2026 · 05:00 UTC
