Logto v1.46.0 is here. It brings OIDC step-up authentication, Sign-In with Ethereum, a way to keep the iOS Save Password prompt, self-service personal access tokens, and a round of security hardening.
Logto v1.46.0 introduces OIDC step-up authentication for sensitive actions, Sign-In with Ethereum, a way to keep the iOS "Save Password" prompt, and self-service personal access tokens in Account Center, along with GeeTest CAPTCHA, SAML static attributes, and a round of security hardening. Here's what's new.
Apps can now require a recent or stronger sign-in before sensitive actions, using standard OIDC parameters.
acr_values and max_age in the authorization request, then read acr, amr, and auth_time from ID tokens, access tokens, and introspection responses. Supported ACR values are advertised in the discovery document.max_age.See the Step-up authentication guide for setup and details.
The new Ethereum Wallet social connector (@logto/connector-siwe) lets users sign in with an EVM wallet. Users with a browser wallet (an injected EIP-1193 provider) sign a one-time Sign-In with Ethereum (EIP-4361) message without leaving the sign-in page. One address works across supported EVM chains, and admins can restrict the allowed chain IDs.
On iOS, ASWebAuthenticationSession closes as soon as it sees the app's callback URL, which dismisses the system "Save Password" prompt right after a password sign-in.
Pass the new confirm_redirect_policy=password sign-in parameter to show a "Continue" page after the user enters a password. The page returns to the app only when the user selects "Continue", so the prompt stays on screen. Without the parameter, Logto redirects back right away as before.
The Swift integration guide in Console shows how to use it. See Keep the iOS Save Password prompt.
When personal access tokens are turned on in Account Center, users can create, rename, and revoke their own tokens on the Account Center Security page. Each token is shown only once at creation and expires within 365 days.
The same operations are available through the Account API under /api/my-account/personal-access-tokens, with the new urn:logto:scope:personal_access_tokens scope.
mfa.required through the Management API. The user must set up MFA on their next sign-in, regardless of the organization-level MFA policy.$5$ and $6$) password hashes using the Legacy password algorithm.access_denied when sign-in is cancelled: Cancelling the consent page, or a failed direct sign-in, now returns the user to the client app with access_denied. Custom sign-in experiences can end an interaction the same way with POST /api/experience/abort.login_hint for Account Center: Add login_hint to any Account Center URL to pre-fill the identifier when the user needs to sign in.staticAttributes in the Management API.same-origin-allow-popups or same-origin under Console > Sign-in experience > Branding > Bring your UI. The default sends no header, so apps that open sign-in in a popup keep working.GET /api/users accepts a repeatable customData query parameter, for example customData={"customId":114514}.GET /api/organizations accepts a jitEmailDomain query parameter that returns the organizations a user with that email domain would be provisioned into.hasPassword for organization members: GET /api/organizations/:id/users now shows whether each member has a password set.deliveryId: Every webhook payload now carries a deliveryId that stays the same across retries, so receivers can process each delivery exactly once. It is also the ID of the delivery's audit log entry.This release includes security fixes across MFA, social and enterprise sign-in, the Account API, and Logto Tunnel.
Range requests when serving static files.See the v1.46.0 release notes for the full details.
502 connector.social_provider_unreachable, a declined authorization returns 401 connector.authorization_failed, and connector errors show the provider's actual message instead of {}.scope values: Refresh token requests from clients such as OpenAI Codex that send a scope with a leading space no longer fail with invalid_scope, so users stay signed in.customClientMetadata keys, so typos such as refreshTokenTtlInDay no longer pass silently.o365role now carry the user's value instead of a literal placeholder.expires_in as a string and scope as an array in token responses, and the Patreon connector moves to Patreon API v2 so Patreon sign-in works again.Cannot find 'client' in scope error. (Thanks to @timokoethe).logto db alteration deploy) after upgrading and before starting the new version./console request does not match any configured admin endpoint, which helps catch a misconfigured ADMIN_ENDPOINT.Thanks to the community members whose work shipped in this release:
deliveryId (#9882), hasPassword for organization members (#9883), organization filter by just-in-time provisioning domain (#9912), customClientMetadata key validation (#9931), clearer social sign-in errors (#9879, #9880), database connection retries (#9881, #9928), and connector request error handling (#9849)ADMIN_ENDPOINT mismatch warning (#9408)Ready to upgrade? Check out our upgrade guide for step-by-step instructions.
For the complete list of changes, see the GitHub release page.
Have questions or feedback? Join us on Discord or open an issue on GitHub.