ThunderID v0.47.0

ThunderID is a lightweight, open-source Identity and Access Management (IAM) engine built to secure access for humans, AI agents, and machines.

Designed for the agentic era, ThunderID provides a developer-first IAM platform and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.

Core design goals of ThunderID include:

• Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
• Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
• Cloud-native IAM: Provide a lightweight, containerized identity product that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.
• Post-quantum-safe security: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.

Getting Started

Get started by exploring how ThunderID can be used to secure:

• Applications - by following Securing B2C Application Guide
• AI Agents - by following Securing AI Agents Guide
• MCP - by following Securing MCP Guide

To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.

Visit Get ThunderID to learn more about installation methods.

What's Changed

⚠️ Breaking Changes

• Refactor mobileNumber attribute to snake_case by @NutharaNR in #3498
• Remove redundant entity-level certificates by @Yathusiga27 in #3475
• Add dynamic cors support. by @ImalshaD in #3553
• Update consent server version by @ThumulaPerera in #3518
• Remove SKIP_SECURITY and create default resources in-process by @UdeshAthukorala in #3381
• Standardize context variable resolution pattern in HttpRequestExecutor by @kavix in #3636
• Support configuring the log level via deployment.yaml by @UdeshAthukorala in #3693
• Verify Flow Secret for backend applications at flow initiation by @Malith-19 in #3476
• Fix pagination link issue in OU handle based user and group listing APIs by @AnuradhaSK in #3722

🚀 Features

• Support Server-wide generic store support. by @ImalshaD in #3512
• Add call node core implementation by @ThaminduDilshan in #3650
• Add Server Configurations UI support. by @ImalshaD in #3699
• Add flow definition validator by @NutharaNR in #3543
• Add call node components to the flow builder and gate UI by @ThaminduDilshan in #3738
• Add RFC 7009 token revocation with deny-list enforcement by @indeewari in #3727

✨ Improvements

• Refactor server-key cryptography by @Osara-B in #3485
• Added and moved providers into thunderidengine package by @anushasunkada in #3530
• Moved ConsentEnforcer interface to thunderidengine by @anushasunkada in #3567
• Update Next.js SDK docs & Remove B2B SDK docs by @brionmario in #3570
• Renamed the provider interfaces by @anushasunkada in #3580
• Propagate correlation ID to outbound HTTP requests by @UdeshAthukorala in #3422
• Add /integrate commands to ThunderID CLI by @brionmario in #3625
• Add kind discriminator for MCP resource server tools and resources by @sahandilshan in #3550
• Update default agent type schema with structured attributes by @Dilusha-Madushan in #3545
• Clarifying default owner behaviour in agent create wizard by @Dilusha-Madushan in #3646
• Refactor and improve verifiable credentials quick-start by @thiva-k in #3632
• Added coverage and added observabilityProvider and authzprovider by @anushasunkada in #3633
• Add theme usages endpoint and pre-delete confirmation UI by @rajithacharith in #3208
• Add multi-auth mode support to Wayfinder sample by @Dilusha-Madushan in #3319
• Improve VC and wallet onboarding UI by @thiva-k in #3656
• Render MCP resource servers with an MCP-native Capabilities view by @sahandilshan in #3551
• Add import/export support to server_configs by @ImalshaD in #3706
• Add usage service registry and flow usages support by @rajithacharith in #3362
• Add Connections API and console UI by @JayaShakthi97 in #3536
• Parameterize I18nMessage to move runtime values out of DefaultValue by @UdeshAthukorala in #3665
• Auto-configure CORS allowed origins for source dev mode by @ImalshaD in #3711
• Decouple JOSE config from the global server config by @Osara-B in #3614
• Add usage support for users by @rajithacharith in #3712
• Add verifiable credentials samples, try-out and protocol docs by @thiva-k in #3704
• Support OU bounded role listing API by @AnuradhaSK in #3528
• Block user deletion when blocking dependencies are present by @rajithacharith in #3740

🐛 Bug Fixes

• Fix Resource Server identifier update error from Console by @Yathusiga27 in #3542
• Force consent reprompt on every CIBA request by @Dilusha-Madushan in #3596
• Fix bootstrap YAML parser bug with CRLF line endings by @ravindu439 in #3691
• Update certificate generation in build.ps1 scripts by @ravindu439 in #3671
• Improvement to the Email Executor and MagicLink Executor by @RandithaK in #3666
• Fix wayfinder declarative resources by @ThaminduDilshan in #3748

New Contributors

• @ImalshaD made their first contribution in #3512

Full Changelog: v0.46.0...v0.47.0

License

Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.

---

(c) Copyright 2026 WSO2 LLC.