Ory — Auth, Security product updates and releases, tracked on megachangelog.
Ory v26.2.0 includes numerous bug fixes spanning identity management, OIDC linking/unlinking, recovery code handling, and data consistency issues. The release also adds new features such as captcha strategies for recovery and verification flows, native API flow support for passkeys, auto account linking for Google and Apple, and improved multi-region query performance.
Ory Kratos v25.4.0 introduces passwordless authentication via SMS, expanded passkey and WebAuthn support, enhanced SAML and OIDC features, new event emission for observability, and significant database optimizations. The release includes breaking changes to the Sessions API, account linking responses, and OIDC registration node groups.
Added support for verifying Android passkeys via WebAuthn/Passkey exchange, including Android APK origin verification. This release also upgrades go-webauthn and includes fixes for Go 1.23.
Ory Kratos v1.3.0 introduces Identifier First Authentication for streamlined sign-in, improved OIDC account linking UI with reduced error rates, Salesforce identity provider support, enhanced social login with better double-submit handling, improved OTP MFA, and multiple bug fixes including security vulnerabilities. Several breaking changes require schema updates and parameter adjustments.
Ory Kratos v1.2.0 introduces two-step registration that separates identity entry from credential selection, and full PassKey support with resident keys for offline authentication. This release includes 107 commits with improvements to webhooks, social sign-in resilience, credential discovery, and enhanced security.
Ory Kratos v1.1 introduces over 270 commits with major features including phone verification and 2FA via SMS, internationalization support, native sign-in with Google and Apple on mobile, account linking, passwordless magic code authentication, and session to JWT conversion. Additional improvements include better email reliability, enhanced API performance with keyset pagination, WebAuthn multi-origin support, and significant recovery flow improvements on native apps.
Ory Kratos v1.0 marks the graduation of the identity and user management platform to stable, production-ready status, processing over 100 million API requests daily. The release includes new features like social login via OpenID Connect, HTTP email support, multi-region support, and numerous performance improvements and bug fixes.
Ory Kratos v0.13.0 brings API stability with new social sign-in options (Patreon OIDC, LinkedIn), enhanced admin API for credential management, and significant performance improvements including optimized whoami calls and asynchronous webhooks. The release also introduces new webhook configuration for identity data updates during registration and anti-account-enumeration measures for recovery flows.
Bug fixes and performance optimizations for Ory Kratos including improved database indexing for identity operations, enhanced tracing capabilities, and fixes for CORS headers, TOTP encoding, and webhook handling. Breaking change: the /admin/courier/messages endpoint now uses keyset pagination instead.
Ory Kratos 0.11.0 introduces verification and recovery codes as the default strategy, support for MD5 password import, OAuth2 provider integration with Ory Hydra, SDK v1 release, new session management APIs with device information, webhooks with blocking and asynchronous capabilities, and numerous bug fixes and improvements.
7 more changes from Ory. Sign up to read the whole changelog.
Sign up freeGitHub or email — no card needed.