Logto v1.39.0 is here, bringing safer signing key rotation, smarter JWT script error handling, expanded Account Center security controls, WhatsApp connector support, and key security improvements
We’re thrilled to introduce Logto v1.39.0, a release focused on stronger operational safety, more flexible token customization, and improved end-user account security. This version adds a grace period for private signing key rotation, configurable error handling for custom JWT scripts, a new Account Center security page, WhatsApp connector support via Meta Cloud API, and several security and reliability improvements across authentication flows.
Logto now supports a grace period during private signing key rotation.
This can be configured through:
PRIVATE_KEY_ROTATION_GRACE_PERIOD environment variable.--gracePeriod CLI option.During the grace period:
After the grace period ends:
This provides a smoother key rotation process and helps avoid authentication failures caused by stale JWKS caches.
Documentation: Rotate signing keys
Logto now supports configurable error handling for custom JWT scripts used in access token and client credentials flows.
Included changes:
api.denyAccess() is preserved as an access_denied response.invalid_request responses.blockIssuanceOnError to enabled.This helps developers choose whether token customization failures should fail open or fail closed depending on their security requirements.
This release adds a new security page to the out-of-the-box Account Center.
End users can now manage account security from /account/security, including:
Console support:
A new WhatsApp connector is added for sending messages through the Meta Cloud API.
This enables WhatsApp-based SMS / verification-code delivery scenarios using the official Meta Cloud API integration.
Organization user and role assignment APIs now return response bodies.
Updated endpoints:
POST /organizations/:id/users now returns { userIds: string[] }, echoing the user IDs sent in the request.POST /organizations/:id/users/:userId/roles now returns { organizationRoleIds: string[] }, containing the final deduplicated role IDs assigned to the user, including IDs resolved from provided role names.Console themes now include the missing --color-overlay-primary-subtle token for both light and dark modes.
Forgot-password verification now returns a unified verification_code.code_mismatch error.
This prevents the flow from exposing whether an email or phone number exists through different error responses.
Improved social and SSO redirect reliability in in-app browsers such as Instagram, Facebook, and LINE.
Some in-app browsers open OAuth identity provider pages in a new WebView, which can cause sessionStorage to be lost after redirecting back.
This release adds a localStorage fallback:
sessionStorage.localStorage.localStorage if sessionStorage is missing.Fixed an issue where the request IP was not passed to connectors when sending verification codes.
This allows connectors to receive the correct request context for verification-code delivery.