ThunderID v0.48.0

ThunderID is a lightweight, open-source Identity and Access Management (IAM) engine built to secure access for humans, AI agents, and machines.

Designed for the agentic era, ThunderID provides a developer-first IAM platform and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.

Core design goals of ThunderID include:

• Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
• Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
• Cloud-native IAM: Provide a lightweight, containerized identity product that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.
• Post-quantum-safe security: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.

Getting Started

Get started by exploring how ThunderID can be used to secure:

• Applications - by following Securing B2C Application Guide
• AI Agents - by following Securing AI Agents Guide
• MCP - by following Securing MCP Guide

To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.

Visit Get ThunderID to learn more about installation methods.

What's Changed

⚠️ Breaking Changes

• Introduce generic OTPExecutor with channel-agnostic OTP generation by @Dilusha-Madushan in #3477
• Add sql support for runtimestore by @senthalan in #3818
• Split access token config by subject (userConfig/clientConfig) and embed client attributes as claims by @Dilusha-Madushan in #3737
• Gate atomic authentication APIs with a server-level secret by @Malith-19 in #3762
• Move flowSecret to a request header for /flow/execute by @Malith-19 in #3808
• Update default bootstrap flows by @ThaminduDilshan in #3898
• Attribute Cache is updated to use RuntimeStoreProvider by @anushasunkada in #3863

🚀 Features

• Add attribute library and schema builder UX for user types by @sadilchamishka in #3607
• Add MCP client application type support to Console UI by @sahandilshan in #3746
• Resolve federated users by a configurable IdP attribute by @sadilchamishka in #3676
• Add admin password reset for users by @NutharaNR in #3858
• Add flow-centric browser SSO by @madurangasiriwardena in #3779

✨ Improvements

• Block connection deletion when in use by @rajithacharith in #3751
• Added runtimestore provider interface by @anushasunkada in #3730
• Route http.Server connection errors through the system logger by @rajithacharith in #3768
• Improve revocation convensions by @indeewari in #3772
• Bind authentication assertion to auth request ID by @ThaminduDilshan in #3776
• Optimize cors runtime. by @ImalshaD in #3781
• Update default bootstrap flows and flow templates by @ThaminduDilshan in #3790
• Support writing application logs to a file with rotation by @UdeshAthukorala in #3773
• Block connection deletion when dependencies exist by @rajithacharith in #3793
• Enforce token revocation inside the token validator by @indeewari in #3803
• Cascade delete role and group assignments on user deletion by @rajithacharith in #3802
• Add Email OTP flow components by @ThaminduDilshan in #3817
• Cascade deletion support for apps, agents and groups by @rajithacharith in #3826
• Add support for one time use inputs by @NutharaNR in #3724
• Add SAN extension to RSA certificate generation by @sahandilshan in #3856
• Unify resource deletion behavior through the dependency registry by @rajithacharith in #3841
• Enforce token revocation at the Resource Server request path by @indeewari in #3839
• Update mcp server UI by @sahandilshan in #3791
• Add AuthZEN authorization to Wayfinder MCP tools by @Yathusiga27 in #3775
• Add support to configure CSS Classes via flows by @brionmario in #3859
• Added resource indicator to the console config by @ImalshaD in #3862
• Simplify public URL configuration by @Osara-B in #3837
• Add OpenChoreo resource type and sample resource by @ayeshajay in #3857
• Implement SMS providers support in Connections page by @JayaShakthi97 in #3720
• Harden static file serving against path traversal and sanitize docs data-page attribute by @UdeshAthukorala in #3882
• Revoke the consumed refresh token on rotation to enforce single-use by @indeewari in #3872
• Support configurable default resource server. by @ImalshaD in #3874
• Improvements on browser SSO by @madurangasiriwardena in #3907
• Update OpenChoreo resource type and sample resource by @ayeshajay in #3910
• Redesign the agent edit page by @Dilusha-Madushan in #3755

🐛 Bug Fixes

• Fix wayfinder sample provisioning in try-consumer CLI flow by @UdeshAthukorala in #3820
• Improvements to display MagicLink Authenticator in Assurance list by @RandithaK in #3767
• Filter OIDC scopes by application scopes by @Yathusiga27 in #3844
• Fix insufficient permissions error during user creation by @ravindu439 in #3770
• Omit query parameters from access logs by @Osara-B in #3889
• Support trusted token audiences for token exchange by @Yathusiga27 in #3881
• Fix user credentials handling in UpdateUser method and update tests by @Sadeesha-Sath in #3884
• Fix Default SMS OTP Flow Template by @Sadeesha-Sath in #3905
• Handle OU deletion i18n errors in the Console by @rajithacharith in #3913

New Contributors

• @ZiyamSanthosh made their first contribution in #3619
• @Sadeesha-Sath made their first contribution in #3884

Full Changelog: v0.47.0...v0.48.0

License

Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.

---

(c) Copyright 2026 WSO2 LLC.