ThunderID v1.0.0-alpha2

ThunderID is a lightweight, open-source Identity and Access Management (IAM) engine built to secure access for humans, AI agents, and machines.

Designed for the agentic era, ThunderID provides a developer-first IAM platform and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.

Core design goals of ThunderID include:

• Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
• Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
• Cloud-native IAM: Provide a lightweight, containerized identity product that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.
• Post-quantum-safe security: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.

Getting Started

Get started by exploring how ThunderID can be used to secure:

• Applications - by following Securing B2C Application Guide
• AI Agents - by following Securing AI Agents Guide
• MCP - by following Securing MCP Guide

To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.

Visit Get ThunderID to learn more about installation methods.

What's Changed

⚠️ Breaking Changes

• jti, auth_code and auth_req store is using RuntimeStoreProvider by @anushasunkada in #4172
• Add multiple authentication provider support by @ThumulaPerera in #3308
• Validate private_key_jwt assertion audience against the issuer by @thiva-k in #4220
• Add Enroll, InitiateAuthentication, InitiateEnrollment methods to AuthnProvider interface by @ThumulaPerera in #4241
• Return default OIDC scope-to-claims mappings in API responses by @thiva-k in #4209
• Apply a default sign-out flow automatically instead of an enable toggle by @madurangasiriwardena in #4332
• Move CIBA Store to runtime by @senthalan in #4350
• Add application type attribute by @Malith-19 in #4321
• Improve handling flow configurations by @ThaminduDilshan in #4371

✨ Improvements

• Add gate_client Console runtime config for OAuth redirect URI by @JayaShakthi97 in #4089
• [Bug-fix] Add nonce generation for oidc auth by @NutharaNR in #4008
• Move Direct Auth Secret gating into the authn service by @Malith-19 in #4088
• Improve flow builder canvas interactions by @DonOmalVindula in #4053
• Updates to quickstarts by @himeshsiriwardana in #4146
• Remove the client ID field from trusted issuer forms and clarify the trusted token audience copy by @sahandilshan in #4144
• Improve flow builder auto-layout and lazy-load the ELK engine by @DonOmalVindula in #4153
• Fix drag and drop to Nested Stack Components in Flow builder by @Sadeesha-Sath in #4002
• Log HTTP error responses by status class in WriteJSONError by @Dilusha-Madushan in #4169
• Provide RFC 8707 support in CIBA grant type. by @ImalshaD in #4166
• Rename Call flow node label to Flow by @chamals3n4 in #3998
• Reduce access log noise from frontend paths by @Osara-B in #4097
• Add client-level default token audience config by @thiva-k in #4198
• Improve the end-user flow preview panel by @DonOmalVindula in #4161
• Brand and localize sign-out flow resources by @madurangasiriwardena in #4206
• Moved metadata building methods to executor interface by @anushasunkada in #4216
• Expand the Applications logo picker beyond emoji and URL by @brionmario in #4235
• Enable SSO and RP-initiated logout for the console application by @madurangasiriwardena in #4242
• Restructure docs directories so URLs reflect the actual category by @himeshsiriwardana in #4160
• Improve executor metadata handling by @ThaminduDilshan in #4261
• Add an Enable SSO toggle to the flow builder for login flows by @DonOmalVindula in #4219
• Add consent flow widget with automatic wiring by @DonOmalVindula in #4264
• Added additional required option methods to the engine by @anushasunkada in #4218
• Bump postcss to v8.5.12 by @ThaminduDilshan in #4301
• Make default agent type schema attributes optional by @Dilusha-Madushan in #4289
• Consolidate the 7 docs skills into one skill with reference files by @himeshsiriwardana in #4199
• Moved supported OAuth grantTypes, responseTypes and AuthMethods to configuration by @anushasunkada in #4296
• Purge expired SSO sessions in runtime-persistent cleanup by @madurangasiriwardena in #4256
• Add agent system-attribute, OU claims and Groups & Roles claims by @Dilusha-Madushan in #4214
• Add token family id (tfid) for grant-scoped revocation by @indeewari in #4300
• Update react-router to 7.18.1 to fix DoS advisory by @rajithacharith in #4335
• Make id_token_hint optional for RP-initiated logout by @madurangasiriwardena in #4299
• Improve token exchange errors by @thiva-k in #4313
• Upgrade react-router to v8.3.0 and update postcss to 8.5.18 by @ThaminduDilshan in #4337
• Update dependency by @jeradrutnam in #4348
• Added WithAttestationProvider option by @anushasunkada in #4336
• Moved transactioner interface to pkg by @anushasunkada in #4359
• Fix user add to use onboarding flow by @jeradrutnam in #4327
• Add support to attach Flows & Layouts at the OU level by @brionmario in #4302
• Improve verifiable credentials tryout by @thiva-k in #4351
• Introduce configurable OTP properties with flow-level overrides by @HesandaLiyanage in #4003
• Remove openchoreo release artifacts by @ayeshajay in #4328
• Added captcha validation provider into engine options by @anushasunkada in #4363
• Move agent Delegated mode toggle to the Advanced tab by @Dilusha-Madushan in #4318
• Add undo/redo and unsaved-changes protection to the flow builder by @DonOmalVindula in #4278
• Speed up PR builder with pnpm/turbo caching, job consolidation, and parallel E2E workers by @DonOmalVindula in #4269
• Make preflight checks the root of the PR builder job graph by @DonOmalVindula in #4370
• Remove resource level permissions from default resources by @rajithacharith in #4368
• Move Passkey Allowed Origin Configuration to Application-Level Configuration by @NutharaNR in #4331
• Shard console app tests across parallel jobs by @DonOmalVindula in #4376
• Add an Application/User sub-tab split to the application token tab by @Dilusha-Madushan in #4333
• Adding initiator request param during PAR and flow by @anushasunkada in #4388

🐛 Bug Fixes

• [Bug-fix] Fix loose hanging onFailure Nodes of email/sms send executors by @NutharaNR in #4038
• [Bug-fix] Fix validation on required properties by @NutharaNR in #4049
• Remove the delimiter from the hint text by @Sadeesha-Sath in #3997
• Reject unsupported OAuth response modes by @Yathusiga27 in #4156
• Validate Call flow references against app flows by @ThaminduDilshan in #4179
• Fix invite page hanging on Add Another User by @Osara-B in #4136
• [Bug-fix] Treat empty values as absent when enriching inputs from forwarded data by @NutharaNR in #4187
• Remove OIDC fields from OAuth metadata by @Yathusiga27 in #4194
• Require a token-issuing grant type for refresh_token by @PasinduYeshan in #4192
• [Bug-fix] Fix debounce issue in header key value update by @NutharaNR in #4201
• [Bug-fix] Update templates and console to use call node instead of links by @NutharaNR in #4113
• Skip user type step in Create User when only one type exists by @PasinduYeshan in #4165
• [Bug-fix] Fix displaying two error messages in sign up flow by @NutharaNR in #4270
• Fix save behaviour in Application Edit Page by @Sadeesha-Sath in #4141
• Add missing frontend locales for App Error Codes by @Sadeesha-Sath in #4159
• Improve CLI tool to prompt for admin credentials and generate random password by @ZiyamSanthosh in #4248
• Fix Console import resource type identification by @rajithacharith in #4232
• Default the agent edit Token tab to the Agent sub-tab by @Dilusha-Madushan in #4174
• Resolve Permission resolution in authorization_code/CIBA flows is not scoped to the requested resource server by @ImalshaD in #4190
• Fix credential routing by @ThumulaPerera in #4329
• Fix issues with helm install for default credentials generation by @ZiyamSanthosh in #4323
• Fix issue with windows run command by @ZiyamSanthosh in #4251
• Honour the id specified when importing a layout by @rajithacharith in #4330
• Pass afterSignOutUrl to the console ThunderIDProvider by @madurangasiriwardena in #4369

New Contributors

• @ayshsandu made their first contribution in #3999
• @chamals3n4 made their first contribution in #3998

Full Changelog: v1.0.0-alpha...v1.0.0-alpha2

License

Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.

---

(c) Copyright 2026 WSO2 LLC.