Logto v1.36 brings wildcard redirect URI support for preview deployments, app-level token exchange control, trust unverified email option for OIDC connectors, and the ability to skip identifier collection for social sign-in.
Logto v1.36 is here. This release brings wildcard redirect URI support, app-level token exchange control, and the ability to trust unverified emails in OIDC connectors.
Thanks to community contributor @Arochka, you can now use wildcard patterns (*) in redirect URIs. This is especially useful for dynamic environments like preview
deployments where URLs are generated on the fly.
Rules for web applications:
Token exchange is now available for machine-to-machine applications, and you have fine-grained control over which apps can use it.
allowTokenExchange setting in application configurationSome identity providers don't return email_verified or return it as false even when the email is valid. You can now configure OIDC social connectors and enterprise SSO connectors to sync emails
regardless of verification status.
Enable trustUnverifiedEmail in your connector config (default is false). This option is available in the Admin Console for OIDC and Azure AD SSO connectors.
Apple App Store guidelines require that "Sign in with Apple" doesn't ask for additional information beyond what Apple provides. To help with this, we've added a new option to skip mandatory identifier
collection during social sign-in.
Find the "Require users to provide missing sign-up identifier" checkbox in the Social sign-in section of your sign-in experience settings.
User role APIs now return results
POST /users/:userId/roles returns { roleIds, addedRoleIds } showing which roles were newly assignedPUT /users/:userId/roles returns { roleIds } confirming the final stateNew createApiClient function in @logto/api
Create a type-safe API client with your own token retrieval logic for custom authentication flows.
DATABASE_STATEMENT_TIMEOUT=DISABLE_TIMEOUT for PgBouncer/RDS Proxy compatibility