github.com/thunder-id/thunderid

ThunderID is a lightweight, open-source IAM stack built to secure access for humans, AI agents, and machines.

Designed for the agentic era, ThunderID provides a developer-first IAM stack and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.

Core design goals of ThunderID include:

• Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
• Post-quantum-safe by design: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.
• Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
• Lightweight runtime with GitOps support: Provide a lightweight, containerized runtime that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.

Getting Started

Get started by exploring how ThunderID can be used to secure:

• Applications - by following Securing B2C Application Guide
• AI Agents - by following Securing AI Agents Guide
• MCP - by following Securing MCP Guide

To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.

Visit Get ThunderID to learn more about installation methods.

Full Changelog: v1.0.0-rc...v1.0.0

License

Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.

[Release] [email protected]

ThunderID is a lightweight, open-source IAM stack built to secure access for humans, AI agents, and machines.

Designed for the agentic era, ThunderID provides a developer-first IAM stack and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.

Core design goals of ThunderID include:

• Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
• Post-quantum-safe by design: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.
• Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
• Lightweight runtime with GitOps support: Provide a lightweight, containerized runtime that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.

Getting Started

Get started by exploring how ThunderID can be used to secure:

• Applications - by following Securing B2C Application Guide
• AI Agents - by following Securing AI Agents Guide
• MCP - by following Securing MCP Guide

To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.

Visit Get ThunderID to learn more about installation methods.

What's Changed

✨ Improvements

• Fix UI consistency issues by @brionmario in #4693
• Update Google logo to the new gradient mark by @brionmario in #4702
• Add CSP documentation and CSP origin hint component by @Osara-B in #4640
• Add support to handle OTP length configuration in flows by @NipuniBhagya in #4688
• Theme builder fixes by @jeradrutnam in #4809
• Enable AI agent and MCP client options on the Get Started page by @Dilusha-Madushan in #4839
• Enhance CORS management with support to configure regexes by @NipuniBhagya in #4833
• Show organization unit details in application overview by @Dilusha-Madushan in #4845
• Make the user profile endpoint optional for OAuth 2.0 connections by @thiva-k in #4824
• Remove Subject Attribute from API layer by @senthalan in #4892
• Rename default connections displayNames by @jeradrutnam in #4899
• Restore the Delegated mode toggle on the agent Advanced tab by @Dilusha-Madushan in #4923
• Rename google/github flow display names by @ThaminduDilshan in #4925

🐛 Bug Fixes

• Allow SELECT and RESEND elements to be dropped in the flow builder by @PasinduYeshan in #4685
• Fix registration flow template by @Yathusiga27 in #4703
• Set the SMS template on generated MFA OTP send nodes by @PasinduYeshan in #4733
• Roll back the generated sign-in flow when application creation fails by @PasinduYeshan in #4724
• Bootstrap the centered layout and remove the Add Layout action by @ImalshaD in #4760
• Stop the attributes tab from looping renders by @PasinduYeshan in #4765
• Disable adding and deleting resources for read-only resource servers by @rajithacharith in #4786
• Keep the execution node when a button targeting it is deleted by @PasinduYeshan in #4744
• Fix declarative resource server actions listed as server level actions by @rajithacharith in #4785
• Add missing completion screens to email self-invite flow template by @samadhisakunika in #4788
• Remove the unsupported oidc logout endpoint from connections by @thiva-k in #4808
• Apply default flow element variants by @Yathusiga27 in #4784
• Update agent token edit section's monaco setup by @thiva-k in #4804
• Correct allowed user types copy to describe sign-up by @PasinduYeshan in #4766
• Render OTP and magic link expiry as a human readable duration by @ZiyamSanthosh in #4797
• Add authorization executor to generated application sign-in flows by @ImalshaD in #4812
• Fix agent use case setup in the npx CLI by @Dilusha-Madushan in #4818
• Fix Self Sign-Up walkthrough copy in the console application tryout by @PasinduYeshan in #4819
• Hide the non-functional column filter in Console list pages by @Dilusha-Madushan in #4820
• Show the seeded admin in the home Add Users card by @PasinduYeshan in #4823
• Hide existing group members from add tabs by @Yathusiga27 in #4731
• Clear resource permissions when a child action is unselected by @thiva-k in #4816
• Name the issued credential on the one-time secret screen by @ZiyamSanthosh in #4790
• Apply one length rule to all resource names and handles by @PasinduYeshan in #4813
• Gate the edit page Set as default action on resource server type. by @ImalshaD in #4844
• Remove app's registration/ recovery flow when it's disabled by @ThaminduDilshan in #4840
• Resolve bindingMessage in SMS executor for CIBA flows by @thiva-k in #4843
• Fix groups listing pagination by @Yathusiga27 in #4782
• Fix Magic Link widget connection by @PasinduYeshan in #4851
• Sanitize export template variable names by @ZiyamSanthosh in #4794
• Add support for alphanumeric OTP input handling by @NipuniBhagya in #4817
• Prompt for mobile number before generating SMS OTP in signup and signin by @samadhisakunika in #4647
• Hide empty connection category filters by @PasinduYeshan in #4849
• Retain dynamic prompt inputs when a paused prompt is re-rendered by @ZiyamSanthosh in #4837
• Cascade resource, action and resource server deletions to role permissions by @thiva-k in #4834
• Fix retry button label and message pluralization on import summary by @ZiyamSanthosh in #4846
• Hide the recovery flow section from the agent edit page by @Dilusha-Madushan in #4850
• Fix user creation for user types with boolean and number attributes by @thiva-k in #4852
• Fix OTP numeric-only checkbox to match backend default by @ThaminduDilshan in #4860
• Fix incorrect GitHub connection scopes hint by @floze-the-genius in #4783
• Fix Groups/Roles/VC production crash from un-externalized logger subpath by @brionmario in #4863
• Show specific error messages for user onboarding flow failures by @Dilusha-Madushan in #4866
• Add authorization and credential state check on refresh grant by @thiva-k in #4861
• Include roles in the consent prompt attribute list by @thiva-k in #4876
• Remove b2c try it out coming soon tiles by @ThaminduDilshan in #4890
• Fix some UI inconsistencies by @jeradrutnam in #4900
• Revoke the access token on sign out in Console by @brionmario in #4894
• Enable refresh token rotation by default and bound the grant lifetime by @thiva-k in #4926
• Template missing configurations in helm chart by @rajithacharith in #4927

New Contributors

• @lashinijay made their first contribution in #4815
• @floze-the-genius made their first contribution in #4783
• @ShanChathusanda93 made their first contribution in #4534

Full Changelog: v1.0.0-beta2...v1.0.0-rc

License

Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.