Logto v1.44.0 is here. It adds MFA trusted devices, custom and longer user IDs for migrations, Cap as a self-hosted CAPTCHA, authentication policies for SAML applications, a `theme` authentication parameter, and refresh tokens for dynamic app clients such as ChatGPT and Codex.
Logto v1.44.0 adds MFA trusted devices, custom user IDs for migrations, Cap as a self-hosted CAPTCHA, and refresh tokens for dynamic app clients. Here's what's new.
Users who complete MFA can now trust their browser and skip MFA there until the trust expires.
TrustedDevice.Created and TrustedDevice.Deleted webhooks.A trusted device only covers the MFA step of sign-in. Identity verification and other sensitive operations still ask for proof. See the MFA trusted devices guide.
POST /api/users accepts a custom id, so IDs like auth0|abc123 carry over unchanged. See Keep existing user IDs.GET /api/users can find a user by external identity with identityType, identityProvider, and identityId. See Look up by external identity.If Cloudflare Turnstile or Google reCAPTCHA is blocked or unreliable for your users, you can now use Cap, an open-source proof-of-work CAPTCHA you host yourself. Deploy a Cap Standalone instance, then add it in Console > Security > CAPTCHA.
reCAPTCHA Enterprise also gets a configurable score threshold (0.0 to 1.0) in place of the fixed 0.5.
MCP clients such as ChatGPT and Codex request offline_access without prompt=consent, so under OpenID Connect they get no refresh token and users have to sign in again when the access token expires. Turn on Add consent prompt for offline access under Client compatibility in the dynamic app settings, and Logto adds the prompt for them.
This applies only to dynamic apps (CIMD clients). The setting is experimental and off by default.
theme authentication parameter: Pass theme=light or theme=dark to render the sign-in experience in that theme instead of following the OS setting, for the whole flow. See authentication parameters.@logto/api SDK adds paginate(), a typed async iterator over paginated endpoints, plus request timeouts and more reliable token handling.none prompt with other values.corpId is now kept in rawData.Database migration required: Run logto db alteration deploy (or npm run alteration deploy in the core image) before starting v1.44.0. This release widens user ID columns to 128 characters and adds a SAML configuration column. Rolling back fails once any user ID exceeds the old limit.
Leftover PostgreSQL roles: logto db seed now checks for roles left by a previous Logto database before creating any tables, and explains why dropping the database didn't remove them. (Credit @ryanchou1994)
Thanks to the community members whose work shipped in this release:
theme authentication parameter (#9645)none prompt validation (#9596) and DingTalk corpId (#9622)And thanks to @imJack6 for requesting Cap support (#9404).
Ready to upgrade? Check out our upgrade guide for step-by-step instructions.
For the complete list of changes, see the GitHub release page.
Have questions or feedback? Join us on Discord or open an issue on GitHub.