👁️ Heimdall '1'

v5.1.1 - 15 Aug 2026

Fixed

• Tokens are minted with the correct default lifetime, access tokens in non-Leaf MVC apps on the default config previously expired the moment they were created
• Every auth operation starts with a clean error state, so errors() reports only the operation you just ran instead of accumulating results from earlier calls
• Hidden fields stay hidden when their value is null, so a fresh user's roles column never leaks into get() output

Changed

• The token secret now resolves the same way the CSRF secret does: token.secret config, then AUTH_TOKEN_SECRET from your .env, then a secret derived from your APP_KEY. If none of the three exist, token operations throw a clear error instead of signing with a fallback. Leaf MVC apps configure this already and are unaffected — lite apps with an APP_KEY need no changes either