ThunderID v0.46.0
ThunderID is a lightweight, open-source Identity and Access Management (IAM) engine built to secure access for humans, AI agents, and machines.
Designed for the agentic era, ThunderID provides a developer-first IAM platform and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.
Core design goals of ThunderID include:
- Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
- Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
- Cloud-native IAM: Provide a lightweight, containerized identity product that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.
- Post-quantum-safe security: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.
Getting Started
Get started by exploring how ThunderID can be used to secure:
- Applications - by following Securing B2C Application Guide
- AI Agents - by following Securing AI Agents Guide
- MCP - by following Securing MCP Guide
To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.
Visit Get ThunderID to learn more about installation methods.
What's Changed
⚠️ Breaking Changes
- Block SPA creation with native flow execution by @Malith-19 in #3389
- Add OpenID4VCI and verifiable credentials management support by @thiva-k in #3474
✨ Improvements
- added promp=consent support in authorize by @sacrana0 in #3341
- verified_claims support in claims parameter of authorization request by @sacrana0 in #3320
- Add common input validation layer for API request payloads by @samadhisakunika in #3247
- Improvements to Notification Package by @RandithaK in #3397
- Provide UI support for app config improvements by @NutharaNR in #3377
- Move JavaScript SDKs out of the monorepo by @brionmario in #3456
- Add Ask AI via @docsearch/docusaurus-adapter by @himeshsiriwardana in #3473
- Add current node inputs to interceptor context by @NutharaNR in #3462
- Remove SDK build Make commands by @madurangasiriwardena in #3482
🐛 Bug Fixes
- Return specific error for attribute conflicts during user provisioning by @kavix in #3317
- Fix console import summary not listing all resource types by @KD23243 in #3390
- Resolve favicon by OS color scheme and Vite base URL by @KD23243 in #3411
- Reconcile custom sign-in flow selection with method toggles in app creation by @KD23243 in #3466
- Hide Guide tab when no guide exists for selected template variant by @KD23243 in #3472
- Fix stale in-memory graph cache issue in multi-node deployments by @NutharaNR in #3471
New Contributors
Full Changelog: v0.45.0...v0.46.0
License
Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.
(c) Copyright 2026 WSO2 LLC.
