## Highlights - **Wildcard redirect URIs**: Support wildcard patterns (`*`) in redirect URIs for dynamic environments like preview deployments, making development workflows easier. (Thanks [@Arochka](https://github.com/Arochka)!) - **Token exchange app-level control**: Fine-grained control over token exchange grant type per application, with M2M apps now supporting this feature. - **Trust unverified email for SSO**: OIDC social connectors and enterprise SSO connectors can now sync emails even when `email_verified` is missing or false. ## New features & enhancements ### Wildcard patterns in redirect URIs Added support for wildcard patterns (`*`) in redirect URIs to better support dynamic environments like preview deployments. (Contributed by [@Arochka](https://github.com/Arochka) in [#8094](https://github.com/logto-io/logto/pull/8094)) Rules (web only): - Wildcards are allowed for http/https redirect URIs in the hostname and/or pathname - Wildcards are rejected in scheme, port, query, and hash - Hostname wildcard patterns must contain at least one dot to avoid overly broad patterns ### Token exchange grant type with app-level control - Add `allowTokenExchange` field to `customClientMetadata` to control whether an application can initiate token exchange requests - Machine-to-machine applications now support token exchange - All new applications will have token exchange disabled by default; enable it in application settings - For backward compatibility, existing first-party Traditional, Native, and SPA applications will have this enabled - Third-party applications are not allowed to use token exchange - Added UI toggle in Console with risk warning for public clients (SPA / native application) ### Trust unverified email for OIDC connectors - Add `trustUnverifiedEmail` to the OIDC social connector config (default `false`) to allow syncing emails when `email_verified` is missing or false - Apply the setting in core OIDC/Azure OIDC SSO connectors and expose it in the Admin Console ### Skip required identifiers for social sign-in A new option `skipRequiredIdentifiers` is available for social sign-in and sign-up flows. When enabled, users can bypass the mandatory identifier collection step during social sign-in and sign-up. This is particularly useful for iOS apps where Apple App Store guidelines mandate that social sign-in options like "Sign in with Apple" should not require additional information collection beyond what is provided by the social IdP. In the Logto Console, this option is represented as a checkbox labeled "Require users to provide missing sign-up identifier" under the "Social sign-in" section. ### User role API improvements - POST `/users/:userId/roles` now returns `{ roleIds: string[]; addedRoleIds: string[] }` where `roleIds` echoes the requested IDs, and `addedRoleIds` includes only the IDs that were newly created - PUT `/users/:userId/roles` now returns `{ roleIds: string[] }` to confirm the final assigned roles ### @logto/api SDK enhancement Added `createApiClient` function for custom token authentication. This new function allows you to create a type-safe API client with your own token retrieval logic, useful for scenarios like custom authentication flows. ## Bug fixes & stability ### Postgres statement timeout configuration Allow disabling Postgres `statement_timeout` for PgBouncer/RDS Proxy compatibility: - Set `DATABASE_STATEMENT_TIMEOUT=DISABLE_TIMEOUT` to omit the startup parameter ### Enterprise SSO error code fix Fixed the enterprise SSO account not exist error code to use a specific one instead of the generic social account error. ### JIT email domains pagination fix Removed default pagination from `GET /organizations/:id/jit/email-domains` to ensure all JIT email domains are returned in the Console's Organization details page. ### Direct sign-in stability Prevented repeated auto sign-in requests on direct sign-in page that could cause unexpected behavior in certain scenarios. ### Console audit log fixes - Removed deprecated interaction log events from the Console audit log filter menu - Fixed dropdown event key typo that caused empty filter results for several events

 ## Security center in Logto Console We have introduced a new"Security" page in the Logto console, which includes the following features: - Password policy: This feature has been migrated from the "Sign-in Experience" page to the new "Security" page. - CAPTCHA: Enable CAPTCHA for sign-up, sign-in, and password recovery to mitigate automated threats. - Identifier lockout: Temporarily lock an identifier after multiple failed authentication attempts (e.g., consecutive incorrect passwords or verification codes) to prevent brute force access. Refer to [documentation](https://docs.logto.io/security) for more details. ## Captcha bot protection As mentioned in the above "Security" update, you can now enable CAPTCHA bot protection for your sign-in experience with providers such as Google reCAPTCHA enterprise and Cloudflare Turnstile. To enable CAPTCHA bot protection, you need to: 1. Go to Console > Security > CAPTCHA > Bot protection. 2. Select the CAPTCHA provider you want to use. 3. Configure the CAPTCHA provider by following our step-by-step guide. 4. Save the settings. 5. Enable CAPTCHA in the Security page. Then take a preview of your sign-in experience to see the CAPTCHA in action. Refer to [documentation](https://docs.logto.io/security/captcha) for more details. ## Identifier lockout (sentinel) The identifier lockout has always been there protecting your Logto instance. However, previously it is hard-coded and not configurable. Now you can fully customize and override the default rules in the Security center. This update includes the follow 3 parts: 1. Maximum failed attempts: - This limits the number of consecutive failed authentication attempts per identifier within an hour. If the limit is exceeded, the identifier will be temporarily locked out. - Default value: 100 2. Lockout duration (minutes): - This specifies the period during which all authentication attempts for the given identifier are blocked after exceeding the maximum failed attempts. - Default value: 60 minutes 3. Manual unblock: A new API endpoint has been introduced to manually unblock a specified list of identifiers. This feature is useful for administrators to unlock users who have been temporarily locked out due to exceeding the maximum failed attempts. Endpoint: `POST /api/sentinel-activities/delete` This endpoint allows for the bulk deletion of all sentinel activities within an hour in the database based on the provided identifiers, effectively unblocking them. Refer to [documentation](https://docs.logto.io/security/identifier-lockout) for details. ## Magic link (one-time token) support You can now use the "one-time token" to compose magic links, and send them to the end user's email. With a magic link, one can register a new account or sign in directly to the application, without the need to enter a password, or input verification codes. You can also use magic link to invite users to your organizations. ### Example API request to create a one-time token ```bash POST /api/one-time-tokens ``` Request payload: ```jsonc { "email": "user@example.com", // Optional. Defaults to 600 (10 mins). "expiresIn": 3600, // Optional. User will be provisioned to the specified organizations upon successful verification. "context": { "jitOrganizationIds": ["your-org-id"], }, } ``` ### Compose your magic link After you get the one-time token, you can compose a magic link and send it to the end user's email address. The magic link should at least contain the token and the user email as parameters, and should navigate to a landing page in your own application. E.g. `https://yourapp.com/landing-page`. Here's a simple example of what the magic link may look like: ``` https://yourapp.com/landing-page?token=YHwbXSXxQfL02IoxFqr1hGvkB13uTqcd&email=user@example.com ``` Refer to [documentation](https://docs.logto.io/end-user-flows/one-time-token) for more details. ## Support Node v22 Logto now officially supports Node.js v22.14.0 and above. ## Improvements - f41938257: respond 404 for non-existing paths in `/assets` - 7dbcedaa1: move password encyption to separate worker thread - cfedfb306: clean up legacy Experience package - 752d406bd: support string-typed boolean claims in OIDC connector - 59c398442: add Ukranian translation to Experience (credit @HighError) - ba7621005: convert Windows absolute paths to file URLs for dynamic imports (credit @jtmaveryk) ## Security updates and vulnerability fixes ## New Contributors * @HighError made their first contribution in https://github.com/logto-io/logto/pull/7205 * @jtmaveryk made their first contribution in https://github.com/logto-io/logto/pull/7126 **Full Changelog**: https://github.com/logto-io/logto/compare/v1.26.0...v1.27