Identity

Changelog

Everything we'veshipped lately

Product updates, performance work, and security improvements — released continuously and noted here in full.

May 2026

v0.12.0newsecurity

Passkey-first sign-in

  • Passkeys (FIDO2 / WebAuthn) can now be the default primary factor for new tenants — phishing-resistant out of the box.
  • Cross-device passkey flows via hybrid transport for signing in on a second device.
  • Conditional-UI autofill on supported browsers for one-tap sign-in.
v0.11.0new

OAuth 2.0 device authorization grant

  • Added the device grant (RFC 8628) for CLIs, TVs, and other input-constrained clients.
  • User-friendly verification codes with a hosted device-approval screen.
  • Polling and slow-down handling per spec, scoped to the requesting tenant.

April 2026

v0.10.0securityimproved

ES256 token signing with a JWKS endpoint

  • ID tokens are signed with ES256 (ECDSA P-256) and published at a standard JWKS endpoint.
  • RFC 7638 key IDs (kid) on every token; verifiers reject missing or unknown kids.
  • A retired-key grace window makes rotation transparent to active sessions, with an algorithm-confusion guard.

March 2026

v0.9.0new

SAML IdP and SCIM 2.0 groups

  • Qeet ID can now act as a SAML identity provider with RSA-SHA256-signed assertions.
  • SCIM 2.0 provisioning extended from users to groups, including PatchOp membership sync.
  • Just-in-time provisioning maps directory attributes onto roles on first sign-in.
v0.8.1improvedfixed

Faster, explainable permission checks

  • The RBAC /check hot-path is edge-cached, keeping evaluation responsive under spiky load.
  • Authorization decisions now return an explainable grant-path trace — which role or group allowed it, or why it was denied.
  • Fixed a rare cache-invalidation race when a role and a group changed in the same transaction.

February 2026

v0.8.0newimproved

OpenTelemetry tracing and official SDKs

  • End-to-end OpenTelemetry traces across auth, OIDC, RBAC, and webhook dispatch, exportable to any OTLP backend.
  • Official server SDKs published for TypeScript and Go, generated from the OpenAPI contract.
  • Webhook deliveries are HMAC-SHA256 signed and flow through a transactional outbox with retries and a dead-letter queue.

January 2026

v0.7.0newimproved

Per-tenant branding and data residency

  • Upload a logo, set brand colors, and serve sign-in on your own custom domain per tenant.
  • Per-tenant email templates for magic links and verification.
  • Data-residency selector (US / EU) at the tenant level, or self-host the single Go binary anywhere.
Get started

Start building today.Free for developers.

25,000 monthly active users on the house. Production-grade auth, no credit card, no time limit.

Create your account
Talk to sales
  • No credit card
  • 25,000 MAU free
  • SOC 2 · GDPR ready