2026-07-30.0

[fungc-io]

Highlights

Logout without the extra confirmation page.
Authgear now supports id_token_hint in RP-Initiated Logout. When your app passes a valid ID token to the logout endpoint, Authgear ends the session and sends the user straight back to your app, with no confirmation prompt in between.

Integrate with Shopify and other platforms using client_secret_basic.
The token endpoint now accepts client_secret_basic, the default client authentication method in many OIDC libraries and platforms. Apps that only support this method, such as Shopify, can now connect to Authgear directly.

A clearer view of fraud protection.
The Fraud Protection page in the Portal has a new overview tab with a requests chart and top source IPs with location data, plus a logs tab where you can choose which columns to show. Fraud protection also now always allows OTPs to phone numbers the user has already verified, so legitimate users don't get blocked.

Other changes

• The Advanced settings pages in the Portal (Admin API, Account Deletion, Cookie Lifetime, custom email and SMS providers, SAML Certificate, and more) have a new design
• Login errors from social providers now show a readable message instead of a raw error code
• New use_session_cookie option ends the Authgear session when the browser closes
• Fixed: access tokens were not issued when the offline_access scope was missing
• Fixed: the "Discard changes" dialog in the Portal sometimes appeared when nothing had changed
• Fixed: the project setup wizard failed to save when the project name contained a quote
• Misc bug fixes and security improvements