UniAuth
Product changelog

What's new in UniAuth

A detailed history of every feature, improvement, and fix shipped to the platform. Subscribe to stay up to date.

v3.3.0August 19, 2026

One site per product, and links that open the app

  • NewEvery product now has its own site: id.uniauth.id for the native apps, vault.uniauth.id for UniVault, and clip.uniauth.id for UniClip
  • New/product introduces the three products, and the platform and audience story moved to /platform with its content intact
  • NewScanning an Identity Pass or a sign-in QR code opens the UniAuth app directly on iOS, and still resolves in a browser everywhere else
  • ImprovedEvery page on every host is swept at seven viewport widths by an automated check, so nothing scrolls sideways on a phone
  • ImprovedThe mobile menu is pinned to the desktop menu by test: anything reachable on a laptop must be reachable on a phone
  • Fixed/api/oauth/authorize was being limited by an undeclared default; the limit is now declared in every layer and documented at 20 requests per 15 minutes per IP
v3.2.0August 13, 2026

The Mac app, the Locker, and trusted devices

  • NewUniAuth for macOS — a native Mac app with a source list, keyboard shortcuts, and a menu-bar extra that shows live two-factor codes
  • NewThe Locker can be erased on a delay you can cancel, and a failed-attempt policy can start that countdown on your behalf
  • NewPasskeys can be created and used from the apps, including system-wide AutoFill on iPhone, iPad and Mac
  • NewTrusted devices are listed and revocable, so you can see exactly which devices are allowed to skip your second factor
  • ImprovedA native app on a device-locked phone or Mac earns a 90-day session per account, rather than being granted one by default
  • ImprovedPush approvals can be answered from the notification itself, without opening the app
  • ImprovedThe encrypted vault is called the Locker everywhere you can see it — in the apps, on the web, and in email
v3.1.0July 21, 2026

Multi-account sessions, native sign-in, and browser sync

  • NewMultiple accounts in one browser: add an account, switch between them, and keep each one's data isolated from the others
  • NewNative Sign in with Apple, including automatic linking to an existing account that already owns the same verified email address
  • NewA REST sync API at /api/sync/v1 for the UniAuth browser: end-to-end opaque state, per-item collections, and remote device sign-out
  • NewPer-app signed-in devices — see and revoke individual refresh tokens for each connected application
  • ImprovedTrust tiers are self-serve: phone verification and biometric capture no longer wait on an operator
  • ImprovedPlan limits for passkeys, OAuth apps and activity history are read from the database and enforced in the product, not only described on the pricing page
v3.0.0July 7, 2026

UniVault and the Identity Pass

  • NewUniVault — end-to-end encrypted logins, two-factor codes and notes, with the encryption key derived on your device and never sent to us
  • NewIdentity Pass — a shareable identity credential signed with RS256 that anyone can verify against our public JWKS, without asking us
  • NewThe Identity Pass can be added to Apple Wallet as a genuinely signed pass
  • NewAn org scope on OpenID Connect: a client learns the user's identity and role inside that client's own organization, and nothing about any other
  • NewEnterprise accounts — an organization-of-organizations hierarchy with entitlement inheritance and a consolidated billing view
  • ImprovedThe Identity Pass address is rotatable and every field has its own visibility switch, so sharing a pass is not all-or-nothing
  • ImprovedErasing or recovering a vault requires a fresh re-authentication, not merely an unlocked session
v2.9.0June 25, 2026

Per-org Team and Enterprise tiers

  • NewPer-org Team and Enterprise tiers, billed on each organization's own per-seat Stripe subscription
  • NewSelf-serve team creation plus a delegated org-admin panel at /org/[id]/admin for users, groups, clients, domains, SSO, billing, and policies
  • NewEnterprise-gated inbound SSO (SAML SP + OIDC federation), SCIM provisioning, and custom-domain verification — Team plans get 402 upgrade_required
  • ImprovedTeam organizations enforce a 25-member seat cap at both invite and accept time
  • ImprovedCancelling an org's subscription disables its SSO identity providers and revokes SCIM tokens, with automatic restore on re-subscribe
  • ImprovedThe entire org-admin area is now localized across all 7 supported locales
v2.8.6June 16, 2026

Seven languages, end to end

  • NewThe entire product is available in English, French, German, Spanish, Japanese, Traditional Chinese and Simplified Chinese
  • NewTraditional and Simplified Chinese are separate regional locales (zh-TW and zh-CN), not one Chinese behind a script toggle
  • NewA Security Findings tracker in the admin panel, with CSV export, an open-findings trend chart, and audit-to-audit diffs
  • ImprovedMarketing pages are server-rendered per locale, and internal links carry the reader's language, so a non-English visitor never pays a redirect hop
  • ImprovedDocumentation, guides, admin screens and transactional email are translated too, not only the marketing site
  • ImprovedTranslation catalogs moved out of the browser bundle entirely — the client now downloads none of them
v2.8.5June 11, 2026

Inbound federation: SAML SP and OIDC RP

  • NewUniAuth can now be the Service Provider: inbound SAML with an assertion consumer, published metadata, IdP metadata import, and Single Logout from the upstream IdP
  • NewInbound OpenID Connect federation, so an organization can bring the identity provider it already has and keep it
  • NewHome-realm discovery routes a user to their organization's identity provider by the domain of the email address they typed
  • NewPer-client PAR enforcement (RFC 9126 §2.1): a client can be required to push its authorization request
  • ImprovedInbound SAML verification ships with an adversarial test battery covering signature wrapping, comment splicing and unsigned-assertion acceptance
  • ImprovedA real-Postgres validation lane replays every SQL statement the test suite executes against the migrated schema, catching drift that mocks hide
v2.8.4June 4, 2026

FAPI-shaped OAuth: RS256, private_key_jwt, JAR and JARM

  • NewAccess tokens are signed with RS256 and verifiable against the published JWKS, instead of a shared HMAC secret
  • Newprivate_key_jwt client authentication (RFC 7523), including registration with jwks or jwks_uri through dynamic client registration
  • NewJAR — signed request objects at the authorization endpoint (RFC 9101)
  • NewJARM — JWT Secured Authorization Response Mode, so the response from the authorization endpoint is signed as well as the request
  • NewAn EC P-256 signing key and ES256 ID tokens, with the signing algorithm selectable per client
  • ImprovedAn opt-in DPoP-Nonce challenge at the token endpoint (RFC 9449 §8-9), and ETag optimistic concurrency on SCIM Users and Groups (RFC 7644 §3.14)
v2.8.3May 30, 2026

Push approvals, QR sign-in, and delegated org admin

  • NewPush as a second factor, end to end: VAPID keys, a service worker, enrollment, and an approval screen that shows what it is approving
  • NewCross-device QR sign-in is persisted, audited and location-aware, with an eight-digit code at /code as a second way in
  • NewA delegated organization-admin panel covering users, groups, clients, policies and settings, with no platform administrator in the loop
  • NewPer-organization policies that are actually enforced — required MFA, allowed sign-in methods, maximum session length, and an IP allowlist
  • ImprovedA per-client always-allow consent preference, exposed in Connected Apps so a user can take it back
  • ImprovedOptional MaxMind GeoLite2 lookups with a graceful fallback, a two-layer maintenance mode, and a migration runner that ends manual psql
v2.8.2April 24, 2026

SDKs, live demos, and a brand kit

  • NewAn interactive demo that runs a real OAuth PKCE flow rather than a simulation, with per-SDK code beside it
  • NewAn OAuth identity kit — sign-in buttons, trust badges, seals and an embeddable widget — plus a 104-asset brand kit in three sizes
  • NewPopup and redirect authentication modes across the widget, the JavaScript SDK and the React SDK
  • NewMigration guides for Okta and Keycloak, and quickstarts for Laravel, Django, Rails and Spring Boot
  • ImprovedEvery npm install instruction now has a CDN download link beside it
  • FixedPlaceholder data across the marketing site was replaced with real database-backed sources, and the newsletter form now reaches a real backend
v2.8.1April 20, 2026

What your account can tell you about itself

  • NewA user-facing audit trail at /account/audit, alongside consent history and a security-assessment dashboard
  • NewPer-app claim transparency on Authorized Apps: exactly which claims each application receives, per application
  • NewSecurity Alerts and Required Actions pages, so an account can say what happened to it and what it needs from you
  • NewCross-device sign-in by QR code
  • ImprovedData residency and retention disclosures on /account/privacy, and custom attributes surfaced in the profile editor
  • ImprovedRequest-level audit logging on the OAuth endpoints
v2.8.0April 10, 2026

Adaptive consent and enrollment policies

  • NewAdaptive consent flow that adjusts scope requests based on user trust tier
  • NewEnrollment policy engine for step-up authentication requirements
  • ImprovedConsent screen now shows human-readable scope descriptions with data previews
  • FixedConsent revocation no longer leaves orphaned refresh tokens
v2.7.0March 18, 2026

SCIM org-binding and bulk operations

  • NewSCIM provisioning tokens scoped to individual organizations
  • NewBulk user import from JSON with dry-run preview mode
  • ImprovedSCIM group membership sync now handles nested groups
  • ImprovedBulk operations endpoint supports up to 10,000 resources per request
  • FixedSCIM PATCH replace op on multi-valued attributes overwrites correctly
v2.6.0February 22, 2026

Post-quantum session signatures (ML-DSA-44)

  • NewEvery session now carries an ML-DSA-44 (FIPS 204) digital signature
  • NewML-KEM-768 key encapsulation infrastructure for future key rotation
  • ImprovedSession fingerprint verification moved from middleware to touchSession() for accuracy
  • FixedPQC key initialization no longer blocks cold-start instrumentation hook
v2.5.0January 30, 2026

Passkey Conditional UI and social 2FA enforcement

  • NewConditional UI (passkey autofill) support on the login page
  • NewMandatory 2FA on every federated social sign-in (Google, GitHub)
  • ImprovedWebAuthn attestation upgraded to direct mode for enterprise auditing
  • FixedPasskey registration on Safari no longer fails with AbortError on rapid re-attempts
  • FixedSocial login PKCE code_verifier correctly cleared from metadata after exchange
v2.4.0December 15, 2025

Dynamic client registration and DPoP

  • NewRFC 7591 dynamic client registration with admin, authenticated, and open policies
  • NewDPoP proof-of-possession (RFC 9449) for access tokens
  • ImprovedToken exchange (RFC 8693) now supports scope narrowing across client boundaries
  • FixedRefresh token rotation replay detection no longer false-positives on network retries
v2.3.0November 8, 2025

SAML 2.0 IdP with pairwise NameID

  • NewFull SAML 2.0 Identity Provider: SSO, SLO, signed assertions, metadata endpoint
  • NewPairwise subject identifiers for SAML NameID values (same privacy model as OIDC)
  • ImprovedXML parsing hardened against decompression bombs and XXE injection
  • FixedSAML Destination attribute validation now rejects mismatched ACS URLs
v2.2.0October 1, 2025

Tamper-proof audit trail and config export

  • NewHash-chained audit events with actor binding and integrity verification
  • NewFull system config export/import as JSON with dry-run preview
  • ImprovedAudit event categories expanded: auth, admin, oauth, scim, system
  • ImprovedConfig import uses ON CONFLICT upserts for safe merge mode
  • FixedAudit log pagination no longer skips events on exact page boundaries
v2.1.0September 5, 2025

Adaptive threat detection and conditional access

  • NewStatistical login risk scoring across 6 factors with automatic step-up 2FA
  • NewConditional access policies with IP allowlist/blocklist and geo-blocking
  • ImprovedProgressive account lockout now applies equally to password, passkey, and magic-link flows
  • FixedThreat detection baseline no longer resets when user clears activity logs

Stay in the loop

Follow our roadmap to see what's coming next, or get in touch to request a feature.