ThunderID v1.0.0-beta

ThunderID is a lightweight, open-source Identity and Access Management (IAM) engine built to secure access for humans, AI agents, and machines.

Designed for the agentic era, ThunderID provides a developer-first IAM platform and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.

Core design goals of ThunderID include:

• Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
• Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
• Cloud-native IAM: Provide a lightweight, containerized identity product that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.
• Post-quantum-safe security: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.

Getting Started

Get started by exploring how ThunderID can be used to secure:

• Applications - by following Securing B2C Application Guide
• AI Agents - by following Securing AI Agents Guide
• MCP - by following Securing MCP Guide

To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.

Visit Get ThunderID to learn more about installation methods.

What's Changed

⚠️ Breaking Changes

• Remove exporting a zip file by @rajithacharith in #4443

✨ Improvements

• Support grid layouts in the STACK flow element by @DonOmalVindula in #4365
• Consolidate login-flow into the flows feature and flatten flow routes by @DonOmalVindula in #4398
• Add optional logo URL to agents with console fallback by @Dilusha-Madushan in #4390
• Resolve patch coverage from Codecov first and name the source of every verdict by @DonOmalVindula in #4397
• Seed @thunderid/configure-verifiable-presentations by @DonOmalVindula in #4404
• Scope the E2E dependency install to the E2E package by @DonOmalVindula in #4421
• Run only the Chromium E2E projects on pull requests by @DonOmalVindula in #4429
• Stop the pnpm store and Turbo caches from freezing at their first write by @DonOmalVindula in #4427
• Fix laggy typing in flow builder executor property fields by @DonOmalVindula in #4422
• Add mcp application type for MCP client applications by @Malith-19 in #4399
• Revamp application creation flow by @brionmario in #4415
• Update token endpoint auth method in frontend by @thiva-k in #4430
• Throttle SSO session activity touch to cut write load by @madurangasiriwardena in #4257
• Forward the SSO-Check node's session and checkpoint reads to the Session node by @madurangasiriwardena in #4401
• End the SSO session when signing out of the samples by @madurangasiriwardena in #4433
• Seed @thunderid/configure-applications by @DonOmalVindula in #4445
• Fixes current implemented E2E tests including MFA login by @Sadeesha-Sath in #4317
• Add a compact view mode to the flow builder canvas by @DonOmalVindula in #4450
• Sign out without a confirmation prompt by @madurangasiriwardena in #4455
• Turn the button Type selector into an Action selector with a sign-out option by @DonOmalVindula in #4456
• Flag sign-out buttons that do not lead to the session sign-out step by @DonOmalVindula in #4460
• Keep the flow builder canvas still when a node is deleted by @DonOmalVindula in #4470
• Improve the flow builder validation notifications panel design by @DonOmalVindula in #4471
• Add '/users/me/meta' endpoint to retrieve user's schema metadata by @janithjay in #4117
• Measure frontend package coverage in CI by @DonOmalVindula in #4467
• Make Organization Picker & Random name picker consistent by @brionmario in #4444
• Round-trip the prompt action type through the flow builder by @madurangasiriwardena in #4481
• Moved RuntimeCryptoProvider interface to pkg/thunderidengine by @anushasunkada in #4463
• Signal sign-out confirmation with the prompt action type by @madurangasiriwardena in #4480
• Remove dead SCSS and unused validation indicator from flow builder by @DonOmalVindula in #4488
• In-app documentation links support by @brionmario in #4252
• Add dev mode flag for mobile app attestation by @Malith-19 in #4434
• Replace flow builder SCSS with theme-driven styled components by @DonOmalVindula in #4489
• Support OAuth token subject mapping by @ThumulaPerera in #4419
• Replace nested token tabs with an audience selector by @Dilusha-Madushan in #4479
• Rewrite vanilla sample as a Next.js backend-for-frontend app by @Malith-19 in #4418
• Use attributes consistently in token settings by @Dilusha-Madushan in #4533
• Added new classifier methods on jweService by @anushasunkada in #4495

🐛 Bug Fixes

• Allow editing entities after schema tightening by filtering undeclared attributes by @PasinduYeshan in #4253
• [Bug-fix] Improve i18n for input error messages by @NutharaNR in #4266
• Fix home page add button by @jeradrutnam in #4411
• Add Backend Validations for Applications PUT by @Sadeesha-Sath in #4157
• Change Rollback changes labels to 'Reset' by @Sadeesha-Sath in #4249
• Fix missing attestation mapping in declarative app parser by @Malith-19 in #4375
• Strip undeclared user attributes on inbound client update by @PasinduYeshan in #4358
• Improve signing/encryption related token configurations by @thiva-k in #4423
• Validate access token typ header in token exchange grant by @thiva-k in #4437
• Add support to encrypt attribute cache by @ThumulaPerera in #4436
• Fix Reset Bahaviour on All Edit Pages by @Sadeesha-Sath in #4162
• Conformance Bug Fix : Token endpoint returns invalid_request (should be invalid_grant) by @KashiwalHarsh in #4439
• Disable PAR for non-authorization code grant types in console by @thiva-k in #4438
• Remove theme and layout foreign keys from inbound client by @rajithacharith in #4532
• Fix adding users when deployed as federated login to console by @rajithacharith in #4527
• Wire rich text links nested inside flow blocks by @PasinduYeshan in #4550
• Include ID-token-only scope claims in issued ID tokens for code and CIBA flows by @thiva-k in #4554
• Make jwt assertion aud validated as string by @thiva-k in #4544

New Contributors

• @KashiwalHarsh made their first contribution in #4439
• @janithjay made their first contribution in #4117

Full Changelog: v1.0.0-alpha2...v1.0.0-beta

License

Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.