Last release 2 days ago
25 Aug 2026
Ships on a steady schedule
a new release about every 8 days
Rarely documented
notes for 2 of 50 stable releases
Nothing withdrawn
no release was ever pulled
1 years old
459 releases · first in 2025
Release timeline
459 releases since 2025Releases
- v1.0.0-alpha2.0.20260730150907-e1a8d486deb030 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha2.0.20260730141210-705e36fc2f6430 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha2.0.20260730112313-4d56b8eb805d30 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha2.0.20260730101138-f702d4fab9cf30 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha2.0.20260730092427-48689c224adc30 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha2.0.20260730080217-f8b882e6453f30 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha2.0.20260730064442-de74522388c330 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha2.0.20260730051456-54e5d4ee616e30 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha2.0.20260729070810-960e7e3b02f829 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha2.0.20260728134830-84defbcd0e1828 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha228 Jul 2026pre-release
Release notes
Open source →ThunderID is a lightweight, open-source Identity and Access Management (IAM) engine built to secure access for humans, AI agents, and machines.
Designed for the agentic era, ThunderID provides a developer-first IAM platform and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.
Core design goals of ThunderID include:
- Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
- Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
- Cloud-native IAM: Provide a lightweight, containerized identity product that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.
- Post-quantum-safe security: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.
Getting Started
Get started by exploring how ThunderID can be used to secure:
- Applications - by following Securing B2C Application Guide
- AI Agents - by following Securing AI Agents Guide
- MCP - by following Securing MCP Guide
To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.
Visit Get ThunderID to learn more about installation methods.
What's Changed
⚠️ Breaking Changes
- jti, auth_code and auth_req store is using RuntimeStoreProvider by @anushasunkada in #4172
- Add multiple authentication provider support by @ThumulaPerera in #3308
- Validate
private_key_jwtassertion audience against the issuer by @thiva-k in #4220 - Add Enroll, InitiateAuthentication, InitiateEnrollment methods to AuthnProvider interface by @ThumulaPerera in #4241
- Return default OIDC scope-to-claims mappings in API responses by @thiva-k in #4209
- Apply a default sign-out flow automatically instead of an enable toggle by @madurangasiriwardena in #4332
- Move CIBA Store to runtime by @senthalan in #4350
- Add application type attribute by @Malith-19 in #4321
- Improve handling flow configurations by @ThaminduDilshan in #4371
✨ Improvements
- Add
gate_clientConsole runtime config for OAuth redirect URI by @JayaShakthi97 in #4089 - [Bug-fix] Add nonce generation for oidc auth by @NutharaNR in #4008
- Move Direct Auth Secret gating into the authn service by @Malith-19 in #4088
- Improve flow builder canvas interactions by @DonOmalVindula in #4053
- Updates to quickstarts by @himeshsiriwardana in #4146
- Remove the client ID field from trusted issuer forms and clarify the trusted token audience copy by @sahandilshan in #4144
- Improve flow builder auto-layout and lazy-load the ELK engine by @DonOmalVindula in #4153
- Fix drag and drop to Nested Stack Components in Flow builder by @Sadeesha-Sath in #4002
- Log HTTP error responses by status class in WriteJSONError by @Dilusha-Madushan in #4169
- Provide RFC 8707 support in CIBA grant type. by @ImalshaD in #4166
- Rename Call flow node label to Flow by @chamals3n4 in #3998
- Reduce access log noise from frontend paths by @Osara-B in #4097
- Add client-level default token audience config by @thiva-k in #4198
- Improve the end-user flow preview panel by @DonOmalVindula in #4161
- Brand and localize sign-out flow resources by @madurangasiriwardena in #4206
- Moved metadata building methods to executor interface by @anushasunkada in #4216
- Expand the Applications logo picker beyond emoji and URL by @brionmario in #4235
- Enable SSO and RP-initiated logout for the console application by @madurangasiriwardena in #4242
- Restructure docs directories so URLs reflect the actual category by @himeshsiriwardana in #4160
- Improve executor metadata handling by @ThaminduDilshan in #4261
- Add an Enable SSO toggle to the flow builder for login flows by @DonOmalVindula in #4219
- Add consent flow widget with automatic wiring by @DonOmalVindula in #4264
- Added additional required option methods to the engine by @anushasunkada in #4218
- Bump postcss to v8.5.12 by @ThaminduDilshan in #4301
- Make default agent type schema attributes optional by @Dilusha-Madushan in #4289
- Consolidate the 7 docs skills into one skill with reference files by @himeshsiriwardana in #4199
- Moved supported OAuth grantTypes, responseTypes and AuthMethods to configuration by @anushasunkada in #4296
- Purge expired SSO sessions in runtime-persistent cleanup by @madurangasiriwardena in #4256
- Add agent system-attribute, OU claims and Groups & Roles claims by @Dilusha-Madushan in #4214
- Add token family id (tfid) for grant-scoped revocation by @indeewari in #4300
- Update react-router to 7.18.1 to fix DoS advisory by @rajithacharith in #4335
- Make id_token_hint optional for RP-initiated logout by @madurangasiriwardena in #4299
- Improve token exchange errors by @thiva-k in #4313
- Upgrade react-router to v8.3.0 and update postcss to 8.5.18 by @ThaminduDilshan in #4337
- Update dependency by @jeradrutnam in #4348
- Added WithAttestationProvider option by @anushasunkada in #4336
- Moved transactioner interface to pkg by @anushasunkada in #4359
- Fix user add to use onboarding flow by @jeradrutnam in #4327
- Add support to attach Flows & Layouts at the OU level by @brionmario in #4302
- Improve verifiable credentials tryout by @thiva-k in #4351
- Introduce configurable OTP properties with flow-level overrides by @HesandaLiyanage in #4003
- Remove openchoreo release artifacts by @ayeshajay in #4328
- Added captcha validation provider into engine options by @anushasunkada in #4363
- Move agent Delegated mode toggle to the Advanced tab by @Dilusha-Madushan in #4318
- Add undo/redo and unsaved-changes protection to the flow builder by @DonOmalVindula in #4278
- Speed up PR builder with pnpm/turbo caching, job consolidation, and parallel E2E workers by @DonOmalVindula in #4269
- Make preflight checks the root of the PR builder job graph by @DonOmalVindula in #4370
- Remove resource level permissions from default resources by @rajithacharith in #4368
- Move Passkey Allowed Origin Configuration to Application-Level Configuration by @NutharaNR in #4331
- Shard console app tests across parallel jobs by @DonOmalVindula in #4376
- Add an Application/User sub-tab split to the application token tab by @Dilusha-Madushan in #4333
- Adding initiator request param during PAR and flow by @anushasunkada in #4388
🐛 Bug Fixes
- [Bug-fix] Fix loose hanging onFailure Nodes of email/sms send executors by @NutharaNR in #4038
- [Bug-fix] Fix validation on required properties by @NutharaNR in #4049
- Remove the delimiter from the hint text by @Sadeesha-Sath in #3997
- Reject unsupported OAuth response modes by @Yathusiga27 in #4156
- Validate Call flow references against app flows by @ThaminduDilshan in #4179
- Fix invite page hanging on Add Another User by @Osara-B in #4136
- [Bug-fix] Treat empty values as absent when enriching inputs from forwarded data by @NutharaNR in #4187
- Remove OIDC fields from OAuth metadata by @Yathusiga27 in #4194
- Require a token-issuing grant type for refresh_token by @PasinduYeshan in #4192
- [Bug-fix] Fix debounce issue in header key value update by @NutharaNR in #4201
- [Bug-fix] Update templates and console to use call node instead of links by @NutharaNR in #4113
- Skip user type step in Create User when only one type exists by @PasinduYeshan in #4165
- [Bug-fix] Fix displaying two error messages in sign up flow by @NutharaNR in #4270
- Fix save behaviour in Application Edit Page by @Sadeesha-Sath in #4141
- Add missing frontend locales for App Error Codes by @Sadeesha-Sath in #4159
- Improve CLI tool to prompt for admin credentials and generate random password by @ZiyamSanthosh in #4248
- Fix Console import resource type identification by @rajithacharith in #4232
- Default the agent edit Token tab to the Agent sub-tab by @Dilusha-Madushan in #4174
- Resolve Permission resolution in authorization_code/CIBA flows is not scoped to the requested resource server by @ImalshaD in #4190
- Fix credential routing by @ThumulaPerera in #4329
- Fix issues with helm install for default credentials generation by @ZiyamSanthosh in #4323
- Fix issue with windows run command by @ZiyamSanthosh in #4251
- Honour the id specified when importing a layout by @rajithacharith in #4330
- Pass afterSignOutUrl to the console ThunderIDProvider by @madurangasiriwardena in #4369
New Contributors
- @ayshsandu made their first contribution in #3999
- @chamals3n4 made their first contribution in #3998
Full Changelog: v1.0.0-alpha...v1.0.0-alpha2
License
Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.
(c) Copyright 2026 WSO2 LLC.
- v1.0.0-alpha.0.20260728100440-f3509e71cf0a28 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260728090920-bb3ee16202c628 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260728072222-d46470e3a50c28 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260727123602-586dc4975bbe27 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260727120032-07c3144ed4c027 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260727101848-68db79aa10ff27 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260727073431-f117301e588227 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260726190217-d1551679574826 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260726151422-68fe235ed8c826 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260725173204-6da89700553725 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260724125414-a8c13d14fcd224 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260724073223-9f130aee49d724 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260720075849-b3ab2b8c3a4120 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260720063025-756feffa1ccb20 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260719063753-32897ff2c31819 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha.0.20260718072636-aca6f9558eda18 Jul 2026pre-release
Nothing published for this version
- v1.0.0-alpha17 Jul 2026pre-release
Nothing published for this version
- v0.48.1-0.20260720092941-806799a413a820 Jul 2026pre-release
Nothing published for this version
- v0.48.1-0.20260716124251-2d4e9266200316 Jul 2026pre-release
Nothing published for this version
- v0.48.1-0.20260713105045-b8c21f11ca3e13 Jul 2026pre-release
Nothing published for this version
- v0.48.1-0.20260713085924-2d93da83881b13 Jul 2026pre-release
Nothing published for this version
- v0.48.1-0.20260713081408-a242b327185913 Jul 2026pre-release
Nothing published for this version
- v0.48.1-0.20260712123605-fc508ae6f16412 Jul 2026pre-release
Nothing published for this version
- v0.48.1-0.20260711063726-d946d3448c4b11 Jul 2026pre-release
Nothing published for this version
- v0.48.011 Jul 2026
Nothing published for this version
- v0.47.1-0.20260711043021-f145b180c54f11 Jul 2026pre-release
Nothing published for this version
- v0.47.1-0.20260710160105-6e45290c125a10 Jul 2026pre-release
Nothing published for this version
- v0.47.1-0.20260710123310-8956d4296e6a10 Jul 2026pre-release
Nothing published for this version
- v0.47.1-0.20260709191005-047755f5a7ad9 Jul 2026pre-release
Nothing published for this version
- v0.47.1-0.20260707111754-edf35e9469417 Jul 2026pre-release
Nothing published for this version
- v0.47.06 Jul 2026
Nothing published for this version
- v0.46.1-0.20260703172725-7c37be14fe093 Jul 2026pre-release
Nothing published for this version
- v0.46.1-0.20260701183227-d9c454ed06471 Jul 2026pre-release
Nothing published for this version
- v0.46.1-0.20260701124159-a8f0fb52b5c51 Jul 2026pre-release
Nothing published for this version
- v0.46.1-0.20260624151039-47c62d7b7d4a24 Jun 2026pre-release
Nothing published for this version
- v0.46.024 Jun 2026
Nothing published for this version
- v0.45.1-0.20260620140502-86807a953c4c20 Jun 2026pre-release
Nothing published for this version
- v0.45.019 Jun 2026
Nothing published for this version
- v0.44.1-0.20260612182930-fc0922b085b112 Jun 2026pre-release
Nothing published for this version
- v0.44.012 Jun 2026
Nothing published for this version
- v0.43.1-0.20260612102035-628dae280b0112 Jun 2026pre-release
Nothing published for this version
- v0.43.1-0.20260611092209-6a6925547a9f11 Jun 2026pre-release
Nothing published for this version
- v0.43.09 Jun 2026
Nothing published for this version
- v0.42.04 Jun 2026
Nothing published for this version
- v0.41.029 May 2026
Nothing published for this version
- v0.40.1-0.20260522105903-dc6c53485b6d22 May 2026pre-release
Nothing published for this version
- v0.40.021 May 2026
Nothing published for this version
- v0.39.1-0.20260520035629-decd3b127b4020 May 2026pre-release
Nothing published for this version
- v0.39.1-0.20260518162951-14063c2fdb0318 May 2026pre-release
Nothing published for this version