v0.6.0

This release introduces the first official SaaSKit developer tooling ecosystem, making it easier for developers to integrate SaaSKit into their applications and manage SaaSKit resources efficiently.

v0.6.0 completes Phase 6 — SDKs & Developer Tooling, adding language-specific SDKs, a management CLI, and improved developer documentation.

✨ Highlights

Go SDK (sdk/go)

Added the official Go SDK for SaaSKit API integrations.

Features:

• Authentication client support
• User management APIs
• Tenant management APIs
• API key operations
• Typed Go models and responses
• Developer-friendly API client

Developers can now integrate SaaSKit directly into Go applications without manually handling API requests.

JavaScript SDK (sdk/js)

Added the official JavaScript SDK with TypeScript support.

Features:

• Type-safe API client
• Authentication helpers
• User management support
• Tenant operations
• Modern JavaScript/TypeScript integration

Designed for web applications, Node.js services, and frontend frameworks.

SaaSKit CLI

Introduced a new command-line interface for SaaSKit administration and developer workflows.

Capabilities:

• User management
• Tenant management
• API key management
• Local development workflows

The CLI is built using urfave/cli.

📚 Documentation Improvements

Added comprehensive developer documentation:

• SDK Quickstart Guide
• SDK Integration Guide
• Framework integration examples
• CLI usage documentation

Updated README with:

• SDK availability
• CLI features
• Developer tooling overview

🗺️ Roadmap Progress

✅ Phase 6 — SDKs & Developer Tooling completed

SaaSKit now provides:

• Identity foundation
• Multi-tenant architecture
• Authorization primitives
• Official SDKs
• CLI management tools
• Developer documentation

📦 New Project Structure

sdk/
├── go/        # Official Go SDK
└── js/        # Official JavaScript SDK

cmd/
└── saaskit/   # SaaSKit CLI

🔄 Upgrade Notes

This release adds new developer tooling and does not introduce breaking changes.

Existing SaaSKit deployments can upgrade safely.

🙏 Thanks

Thanks to everyone contributing feedback and testing as SaaSKit continues evolving into an open-source, developer-first multi-tenant SaaS foundation.

---

Full Changelog: v0.5.0 → v0.6.0

v0.5.0

Overview

This release introduces secure API key authentication and the first version of SaaSKit's event infrastructure.

With this update, applications can authenticate programmatic access, manage tenant-scoped API credentials, and subscribe to platform events through webhooks.

Highlights

🔑 API Keys

Added support for:

• Secure API key creation and management
• Tenant-scoped credentials
• Key prefixes (sk_live_, sk_test_)
• SHA-256 hashed storage
• Scope-based permissions
• Expiration and revocation
• API key authentication middleware

🔔 Webhooks

Added webhook capabilities:

• Event subscriptions
• Event filtering
• Delivery tracking
• HMAC-SHA256 signed payloads
• Automatic retries with exponential backoff

📡 Event System

Introduced the first SaaSKit event schema:

• User lifecycle events
• Tenant lifecycle events
• API key events
• Session events

Developers can now build integrations around SaaSKit events using a consistent and documented format.

Security Improvements

• API secrets are never stored in plaintext
• Webhook requests can be verified cryptographically
• Tenant isolation is enforced throughout API key handling
• Fine-grained API access control through scopes

Documentation

Added documentation for:

• Event payload formats
• Webhook verification
• Integration guidelines
• Consumer best practices

Developer Experience

This release provides the foundation for:

• Backend integrations
• Automation workflows
• External service synchronization
• Future SDK support

What's Next

Upcoming phases will focus on:

• Developer SDKs
• Audit logging
• Advanced platform operations
• Marketplace and extension ecosystem

---

Thank you to everyone following SaaSKit's development. 🚀

v0.4.0

SaaSKit v0.4.0

This release introduces Extensible Identity Metadata, allowing applications to attach custom structured data to users and organizations without requiring database schema changes.

This completes Phase 4 of the SaaSKit roadmap and significantly improves the platform's flexibility for real-world SaaS applications.

---

🚀 Highlights

Extensible User Metadata

Users now support two metadata stores:

• Public metadata
• Private metadata

This enables applications to safely separate client-visible information from backend-only data while maintaining a consistent identity model.

Typical use cases include:

• Profile preferences
• Application settings
• Feature flags
• CRM identifiers
• Synchronization state
• Internal service data

---

Tenant Metadata

Organizations can now store arbitrary JSON metadata, making it easy to support application-specific configuration without modifying the database schema.

Examples include:

• Branding
• Billing settings
• External system IDs
• Marketplace configuration
• Business preferences
• Custom integrations

---

🔒 RBAC Integration

Metadata operations are fully integrated into SaaSKit's permission system.

New permissions:

• user.metadata.read
• user.metadata.write
• tenant.metadata.read
• tenant.metadata.write

---

⚡ PostgreSQL JSONB

Metadata is powered by PostgreSQL JSONB with:

• GIN indexes
• 32 KB size limits
• Efficient querying
• Flexible document storage

---

📡 Event Driven

Metadata updates now publish system events:

• user.metadata.updated
• tenant.metadata.updated

These events provide the foundation for audit logging, integrations, background workers, and future webhook support.

---

🌐 New API Endpoints

Users

GET   /api/v1/users/me/metadata
PATCH /api/v1/users/me/metadata

Tenants

GET   /api/v1/tenants/{id}/metadata
PATCH /api/v1/tenants/{id}/metadata

---

🧪 Testing

This release adds comprehensive integration tests covering:

• User metadata
• Tenant metadata
• RBAC authorization
• Repository implementations

All tests are passing.

---

Compatibility

✅ No breaking changes.

Simply apply the new database migrations and upgrade as usual.

---

Roadmap

Completed:

• ✅ Phase 0 — Foundation
• ✅ Phase 1 — Identity Core
• ✅ Phase 2 — Multi-Tenancy
• ✅ Phase 3 — RBAC, MFA & Token Security
• ✅ Phase 4 — Extensible Identity Metadata

Next, development will focus on the remaining milestones on the path to SaaSKit v1.0, including enterprise identity features, OpenID Connect certification, SDKs, and production hardening.

Thank you to everyone following and contributing to SaaSKit.

v0.3.0

SaaSKit v0.3.0

This release introduces major security and identity improvements as part of Phase 3 of the SaaSKit roadmap.

🔐 Highlights

Role-Based Access Control (RBAC)

Added a flexible permission-based authorization system:

• New permission model for granular access control
• Added Manager and Viewer tenant roles
• Introduced RequirePermission middleware
• Replaced inline authorization checks with centralized RBAC enforcement

Supported permissions include:

• tenant.read
• tenant.update
• members.invite
• members.remove

---

🔑 Multi-Factor Authentication (MFA)

Added MFA support with TOTP-based authentication.

Features:

• TOTP generation and verification
• AES-256-GCM encrypted MFA secret storage
• Recovery code generation and validation
• Extensible MFA domain supporting future methods:
  • WebAuthn
  • SMS
  • Email

---

🔄 Refresh Token Grace Window Rotation

Improved refresh token security and reliability.

New behavior:

• Added a 10-second grace period during token rotation
• Prevents authentication failures caused by concurrent refresh requests
• Stores previous token metadata securely
• Maintains strong security guarantees while improving user experience

---

🪪 Enhanced JWT Claims

Access tokens now support additional identity context:

• Tenant role
• Permissions
• MFA verification status

---

🧪 Testing

This release includes:

• New RBAC integration tests
• MFA service coverage
• Refresh token rotation tests
• Updated authentication tests

All tests are passing.

---

📦 Upgrade Notes

This release is backward compatible.

No breaking changes are introduced.

Existing deployments can upgrade normally by applying the new database migration:

v0.2.0

SaaSKit v0.2.0

This release introduces the first complete implementation of SaaSKit's multi-tenancy foundation.

The platform now includes tenant persistence, business services, HTTP APIs, integration tests, and the routing changes required to support a cleaner OIDC authentication flow.

Highlights

🚀 Multi-Tenancy Foundation

• Initial tenant database schema.
• SQLC-generated tenant queries.
• Tenant domain and repository implementation.
• Tenant service layer with business validation.
• HTTP APIs for tenant management.
• Membership context support for authenticated requests.

🔐 OIDC Improvements

• Mount the OIDC provider at the application root.
• Align internal authentication and redirect paths.
• Simplify the authentication flow.

✅ Testing

• Comprehensive end-to-end integration tests for tenant lifecycle operations.

📚 Documentation

• Roadmap updated to reflect Phase 2 completion.
• Implementation guide expanded with the new multi-tenancy architecture.

Looking Ahead

With the multi-tenancy foundation now in place, the next development phase will focus on expanding organization capabilities, authorization, and additional identity infrastructure while continuing to strengthen the platform as a production-ready SaaS foundation.

v0.1.0: Identity Developer Preview

SaaSKit v0.1.0 — Identity Developer Preview

We are proud to announce the v0.1.0 "Identity Developer Preview" release of SaaSKit — the open-source SaaS foundation. This release focuses on delivering a production-grade, secure, and standardized authentication and OIDC provider engine.

---

🚀 Key Features

• OIDC Provider & Federation: Standardized OpenID Connect provider endpoints (/.well-known/openid-configuration, /.well-known/jwks.json, /oauth/v2/authorize, /oauth/v2/token, /oauth/v2/userinfo) powered by zitadel/oidc/v3. Includes social login support for Google and GitHub.
• Hardened Security: Automated failed login lockout (locks user status after 5 incorrect password attempts), thread-safe token bucket rate limiter, security headers middleware (HSTS, CSP, X-Frame-Options), and password hashing using Argon2id.
• Envelope Encryption: Highly secure database column protection using AES-256-GCM and HKDF key derivation to protect sensitive external credentials and client secrets at rest.
• Complete Session Management: Full support for secure session tracking, refresh token rotation, and invalidation upon logout.
• Docker & CI/CD: Hardened multi-stage Docker build, development Docker Compose configuration, and automated GitHub Actions CI pipeline running linters, tests, and security scans (govulncheck).

---

📖 Technical Documentation

This release introduces comprehensive guides to get you started:

• Installation Guide — Step-by-step instructions for running locally and deploying to production.
• Configuration Guide — Env variable schema reference and YAML configuration.
• Authentication Guide — In-depth breakdown of login, registration, lockout, and session workflows.
• OIDC Integration Guide — Connecting your frontends and client apps via OAuth/OIDC.
• API Reference — Complete schemas for auth and system endpoints.