ThunderID v1.0.0-alpha

ThunderID is a lightweight, open-source Identity and Access Management (IAM) engine built to secure access for humans, AI agents, and machines.

Designed for the agentic era, ThunderID provides a developer-first IAM platform and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.

Core design goals of ThunderID include:

• Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
• Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
• Cloud-native IAM: Provide a lightweight, containerized identity product that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.
• Post-quantum-safe security: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.

Getting Started

Get started by exploring how ThunderID can be used to secure:

• Applications - by following Securing B2C Application Guide
• AI Agents - by following Securing AI Agents Guide
• MCP - by following Securing MCP Guide

To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.

Visit Get ThunderID to learn more about installation methods.

What's Changed

⚠️ Breaking Changes

• Secure AuthZEN endpoints with direct auth secret by @Yathusiga27 in #3950
• Add resource_type as an attribute in declarative_resources by @rajithacharith in #3163
• Remove handler from Resource server and make the identifier mandatory. by @ImalshaD in #3892
• Implement native consent service by @ThumulaPerera in #4007
• Bind OAuth tokens to one resource server with default fallback by @ImalshaD in #4009
• Update VC to use RuntimeStoreProvider by @thiva-k in #4041
• Retire /identity-provider and /notification-senders/message CRUD APIs in favour of /connections by @JayaShakthi97 in #4019
• Rename userdb to entitydb by @thiva-k in #4056
• Rename operation database to runtime-persistent and runtime database to runtime-transient by @indeewari in #4077

🚀 Features

• Add Identity Assertion Authorization Grant (ID-JAG) support by @sahandilshan in #3893
• Add MLDSA for JWT signing by @hwupathum in #3968
• Add Google Play Integrity attestation for mobile clients by @Malith-19 in #3951
• Implement session sign-out by @madurangasiriwardena in #3973
• Add Apple App Attest attestation for mobile clients by @Malith-19 in #4055

✨ Improvements

• Make Vendor prefixes of SDK components, storage keys configurable via the SDK entrypoints by @brionmario in #3925
• Improve connection configuration UX by @JayaShakthi97 in #3948
• Add documentation authoring skills and clean up docs content by @himeshsiriwardana in #3860
• [CLI] Define a minimum Node.js Version + Add Console URL by @brionmario in #3970
• Add flow type based and basic executor based validation rules by @NutharaNR in #3829
• Serve static frontend files via os.Root and set docs data-page through the dataset API by @UdeshAthukorala in #3923
• Migrate console identity-provider and SMS-provider CRUD to the use /connections API by @JayaShakthi97 in #3964
• Move Application Type selection to a dedicated page by @brionmario in #3966
• Scope docs-lint to changed lines, fix em-dash issues site-wide and more. by @himeshsiriwardana in #4000
• Enhance default admin credentials handling by @ZiyamSanthosh in #3969
• Redesign connection attribute configuration with claim-driven user type resolution by @sadilchamishka in #3906
• Improve flow builder discoverability and add end-user flow preview by @DonOmalVindula in #4015
• Remove search components from listing pages which are not functional by @jeradrutnam in #4030
• Fix style issues related to light variant along with some cross general fixes by @jeradrutnam in #4025
• Improve handling default certs and keys by @ZiyamSanthosh in #4004
• Emit entityState from federated auth executors based on account-linking result by @sadilchamishka in #4026
• Add database.operation support to the Helm chart by @UdeshAthukorala in #4045
• Add admin credential prompt to setup.ps1, matching setup.sh by @samadhisakunika in #4057
• Add Console UI for trusted IDPs and ID-JAG support by @sahandilshan in #4034
• Add default resource server UI by @ImalshaD in #4052
• Move Apple App Attest root certificate to configuration by @Malith-19 in #4081

🐛 Bug Fixes

• Stop custom claims from overwriting reserved JWT claims by @prdai in #3082
• [Bug-fix] Improve attribute uniqueness validator error message by @NutharaNR in #3944
• Fix Wayfinder SQLite support by @Yathusiga27 in #3963
• Support batchwise deletion for Temporary Data Deletion by @Osara-B in #3955
• Remove app-scope intersection from jwt-bearer (ID-JAG) grant by @sahandilshan in #4032
• Fall back to default flow when configured authentication flow is deleted by @rajithacharith in #3991
• Fix disabled and tinted element colors by @Osara-B in #4043
• Remove Obsolete Wayfinder AuthZEN client configuration from YAML files by @Sadeesha-Sath in #4029
• Fix double sign in after logout in console. by @ImalshaD in #4087
• Update helm fix issues by @ZiyamSanthosh in #4103
• Mount config/secrets volume in Docker deployment guides by @Malith-19 in #4138
• Align dbscripts directory names with database names using underscores by @indeewari in #4164
• Provision OpenChoreo ResourceType JWT signing keys from the platform secret store by @rajithacharith in #4177

New Contributors

• @prdai made their first contribution in #3082

Full Changelog: v0.48.0...v1.0.0-alpha

License

Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.

---

(c) Copyright 2026 WSO2 LLC.