ThunderID v1.0.0-beta2

ThunderID is a lightweight, open-source IAM stack built to secure access for humans, AI agents, and machines.

Designed for the agentic era, ThunderID provides a developer-first IAM stack and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.

Core design goals of ThunderID include:

• Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
• Post-quantum-safe by design: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.
• Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
• Lightweight runtime with GitOps support: Provide a lightweight, containerized runtime that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.

Getting Started

Get started by exploring how ThunderID can be used to secure:

• Applications - by following Securing B2C Application Guide
• AI Agents - by following Securing AI Agents Guide
• MCP - by following Securing MCP Guide

To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.

Visit Get ThunderID to learn more about installation methods.

What's Changed

✨ Improvements

• Introduce CSP baseline with file based config by @Osara-B in #4523
• Introduce support to add custom SMS providers by @NipuniBhagya in #4537
• Enable Docusaurus docs and API versioning by @himeshsiriwardana in #4558
• Add support for tracking unsaved changes in token settings by @NipuniBhagya in #4577
• Add overview tab to Applications by @brionmario in #4490
• Add an Overview tab Agents by @brionmario in #4598
• Restructure B2C use-case docs into a problem-to-implementation funnel by @himeshsiriwardana in #4395
• Validate duplicate application names early in the console creation wizard by @pasindubalasooriya in #3924
• Added runtimeCryptoProvider option method by @anushasunkada in #4603
• Offer the default resource server from the wizard and the list by @ImalshaD in #4635
• Add criteria-based revocation administration flows by @indeewari in #4591
• Add agent type export support by @sahandilshan in #4630
• Add per request CSP nonces for script and style src by @Osara-B in #4632
• Bump google.golang.org/grpc from 1.82.0 to 1.82.1 in /backend by @dependabot[bot] in #4664
• Fix UI consistency issues by @brionmario in #4648
• Run console user deletion through a configurable administration flow by @indeewari in #4669
• Add usages endpoints for SMS gateway, Twilio, and Vonage connections by @NipuniBhagya in #4656
• Add nested groups support to the group members UI by @ZiyamSanthosh in #4681
• Introduce user group assignment policies by @ZiyamSanthosh in #4496
• Restrict OpenID4VCI credential issuance to wallet applications by @thiva-k in #4676
• Replace default sign out flow with conditional confirmation by @ZiyamSanthosh in #4628
• Improve OIDC scope-claim mapping and console token UI by @thiva-k in #4631
• Update OC resources and docs by @ayeshajay in #4641

🐛 Bug Fixes

• Recover the gate sign-in page from an expired flow execution by @PasinduYeshan in #4492
• Update Nuxt application template to default tokenEndpointAuthMethod to client_secret_basic by @janithjay in #4573
• Remove the Allow Cross OU provisioning property from federated Executors by @ImalshaD in #4583
• Replace Wayfinder sample SQLite storage with in-memory data by @PasinduYeshan in #4586
• Extend authorization request and auth flow expiry to 60 minutes by @PasinduYeshan in #4539
• Fix the DSN string of SQLite to use modernc pragma syntax so busy_timeout applies by @Sadeesha-Sath in #4536
• Match resource_type only as a plain key when importing sample resources by @PasinduYeshan in #4593
• Conformance Bug Fix: Token endpoint returns unauthorized_client (should be invalid_client/invalid_request) by @KashiwalHarsh in #4482
• Default permission consent toggles to unselected. by @ImalshaD in #4619
• Polish visual issues on the Console Home Page by @brionmario in #4617
• Provide seamless login for OIDC/github connections by defualt. by @ImalshaD in #4543
• Fix attribute library property names and drop phone_number from the default Person schema by @PasinduYeshan in #4615
• Replace automatic Google Font fetching with explicit font import by @Osara-B in #4614
• Fix deployment.yaml override of bool config fields defaulting to true by @rajithacharith in #4602
• Fix cursor positioning in the Import Configuration environment variable editor by @rajithacharith in #4601
• Fix OAuth error propagation by @ThumulaPerera in #4604
• Fix b2c try it out for staff onboarding by @ThaminduDilshan in #4650
• Fix rich-text link wiring in the flow builder by @PasinduYeshan in #4636
• Change Wayfinder Registration Flows to AutoLogin by @Sadeesha-Sath in #4638
• Allow declarative flows to be opened from the flow listing. by @ImalshaD in #4668
• Show Magic Link as an alternative first factor in generated flows by @PasinduYeshan in #4670
• Route registration credential failures back to the credentials prompt by @Dilusha-Madushan in #4674
• Allow translation writes in composite and mutable store modes by @rajithacharith in #4655
• Complete a timed out consent prompt without recording it. by @ImalshaD in #4653
• Add replay protection to private_key_jwt client assertions by @thiva-k in #4673
• Add deny list of credentials accepted by creds auth service by @ThumulaPerera in #4666
• Fix resending OTP in SMS and EmailOTP flows by @ZiyamSanthosh in #4651
• Align React SDK sample URLs with HTTP by @ImalshaD in #4682
• Remove unused callbackType property from auth_assert nodes by @ThumulaPerera in #4684
• Add support for ID-JAG authorization grant profile in OIDC metadata by @sajitha-tj in #4677
• Restore executor-declared outcome handles when loading a flow by @PasinduYeshan in #4675
• Fix CIBA Page rendering by @Thumimku in #4665
• Remove app authorization filtering from token exchange by @ImalshaD in #4687

New Contributors

• @NipuniBhagya made their first contribution in #4537
• @pasindubalasooriya made their first contribution in #3924
• @sajitha-tj made their first contribution in #4677

Full Changelog: v1.0.0-beta...v1.0.0-beta2

License

Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.