Logto v1.38.0 is here. This release brings OAuth 2.0 Device Authorization Grant support, passkey sign-in, adaptive MFA, session and grant management, and more flexible OIDC configuration for OSS deployments.
We're excited to announce Logto v1.38.0, our March 2026 release! This update adds device flow for input-limited apps, introduces passkey sign-in and adaptive MFA improvements, and expands session, grant, and tenant-level configuration controls across Logto.
One of the biggest additions in this release is support for OAuth 2.0 Device Authorization Grant. This makes it much easier to build authentication flows for devices that do not have a full keyboard or browser experience, such as smart TVs, CLI tools, gaming consoles, and IoT devices.
With device flow, users can:
We also added full Console support for device flow applications. You can now create device flow apps by selecting Input-limited app / CLI under Native apps, or by choosing Device flow as the authorization flow when creating an app manually. The application settings page also includes a built-in guide and demo to help you get started.
This release introduces passkey sign-in as a full authentication method in Logto.
Passkey sign-in provides a faster, passwordless experience for returning users while also improving account security. It works with familiar platform authenticators such as Face ID, Touch ID, and Windows Hello.
We added support for several passkey-based user journeys:
For more details, check out our passkey sign-in documentation.
This release continues our investment in modern MFA experiences with two major improvements.
Adaptive MFA is now supported in Logto. When enabled, the sign-in flow evaluates adaptive MFA rules against the current sign-in context and requires MFA when those rules are triggered.
This also includes:
context.interaction.signInContext in custom-claims scriptsPostSignInAdaptiveMfaTriggered webhook eventFor users who are not required to set up MFA, Logto can now show a dedicated onboarding page after credential verification, asking whether they want to enable MFA for better protection.
This is especially useful alongside passkey sign-in, where a user may want to use passkeys for sign-in without necessarily enabling them as an MFA factor at the same time.
This release adds a major set of account and admin controls around user sessions and authorized applications.
Logto now supports session management in both account APIs and management APIs. You can list active sessions, inspect session details, and revoke sessions with optional grant revocation behavior.
We also introduced:
session permission in Account Center settings with off, readOnly, and edit optionsurn:logto:scope:sessions user scope for session-related account API accessOn the Console side, user details now include an Active sessions section and a dedicated session details page with revoke support.
Logto now supports listing and revoking user application grants in both the account and management APIs.
This release also adds an Authorized third-party apps section on the user details page in Console. Admins can now see active third-party authorizations, review metadata such as app name and creation time, and revoke access directly from the UI.
Applications can now define a maxAllowedGrants value in customClientMetadata to limit how many active grants a user can keep for a specific app. Once the configured limit is exceeded, Logto automatically revokes the oldest grants.
Console also includes a new Concurrent device limit section in application details so this can be configured visually.
For OSS users, this release makes OIDC settings more configurable and easier to manage.
You can now define oidc.session.ttl in logto-config to customize the OIDC provider session TTL in seconds. If unset, the default remains 14 days.
We also added:
GET /api/configs/oidc/sessionPATCH /api/configs/oidc/sessionOn the Console side, OSS now gets a new Tenant -> Settings page, with an OIDC settings tab that replaces the old Signing keys page. The new page also includes a Session maximum time to live field for configuring session TTL in days.
If you are running OSS, remember to restart the service after config changes so the new OIDC settings are loaded. If you want config updates to take effect automatically, consider enabling central Redis cache.
The out-of-the-box Account Center also gets several useful upgrades in this release.
Users can now:
/authenticator-app/replace routeidentifier URL parameter to pre-fill identifier fieldsui_locales URL parameterWe also improved password forms for better browser autofill and password manager compatibility.
For teams migrating users into Logto, the GET /users and GET /users/:userId endpoints now support an includePasswordHash query parameter. When enabled, the response includes passwordDigest and passwordAlgorithm, which can help with migration workflows that need raw password hash data.
We also added support for access token exchange in service-to-service delegation scenarios. Logto can now exchange opaque or JWT access tokens for new access tokens with different audiences using the standard urn:ietf:params:oauth:token-type:access_token token type.
This release also includes several stability and compatibility improvements:
findByUid and findByUserCode now use literal JSONB keys so expression indexes can work better under prepared generic plans.hex:-prefixed PBKDF2 salt values during user import.To formatting is now normalized for non-E.164 numbers by ensuring a leading +.This release includes a connector toolkit breaking change.
The long-deprecated mockSmsVerificationCodeFileName export has been removed from @logto/connector-kit.
We also updated the file paths used by mock connectors to store sent message records:
/tmp/logto_mock_email_record.txt -> /tmp/logto/mock_email_record.txt/tmp/logto_mock_sms_record.txt -> /tmp/logto/mock_sms_record.txtIf your local or Docker-based workflows depend on the old paths, you will need to update them.
Thanks to our new contributors for helping improve Logto:
Ready to upgrade? Check out our upgrade guide for step-by-step instructions.
For the complete list of changes, see the GitHub release page.
Have questions or feedback? Join us on Discord or open an issue on GitHub.