loading
Preparing LoginRadius developer resources
Mission: Help enterprises accelerate digital transformation with our fully-managed Customer IAM technology.
Skip to main content

Core API Release 38.0.0

ยท 2 min read
Subscribe via RSS

This release of the LoginRadius Core API adds features, improvements, and a fix.

Changelog

Added

  • Captcha Support in Change Password and Change PIN APIs : The Auth Change Password and Auth Change PIN APIs now accept a CAPTCHA field, allowing tenants to enforce captcha verification on password and PIN change requests.

  • Refresh Token Rotation with Reuse Interval : OAuth applications now support refresh token rotation with a configurable reuse interval. After rotation, the previous token stays valid for the configured grace period, preventing failures from concurrent refresh requests using the same token.

  • JWT Signing Key Rotation and Revocation : Signing keys for JWTs (access and ID tokens) in OAuth applications can now be rotated, revoked, and emergency-revoked via new Management APIs. Per-application signing keys can be generated separately from the global key, and the JWKS endpoint lists active and grace-period keys. Revoked keys are pruned beyond a 10-key limit.

  • Authentication Method Extraction from External IDP Responses : SAML logins now expose the authentication method used at the IDP as a mappable attribute, enabling mapping to profile fields (for example, deriving the AMR claim). Custom IDP attribute mappings to Custom Fields now handle non-string values (arrays, objects) by JSON-stringifying them, so claims like amr (returned as an array) are correctly persisted.

Improved

  • Granular Login Events in Audit Logs : Login events are recorded only when an access token is returned; intermediate states now use distinct event types for more accurate analytics.

  • Structured Audit Logging for OAuth Token Grant Types : Audit logs now record structured event and method data for each OAuth/OIDC token grant type, including refresh token lifecycle events and detailed metadata.

  • Enforce PKCE for OAuth/OIDC Flows : A new EnforcePKCE setting is available in the OAuth application configuration. When enabled, code_challenge is required for any OAuth/OIDC authorization request that includes code in the response_type.

Fixed

Email Domain Access Management : Deny-by-Default with Subdomain Blocking:

  • Blocking a domain now also blocks its subdomains (for example, blocking example.com also blocks sub.example.com).

  • When an allowlist is configured, addresses not on the allowlist or blocklist are now denied by default.

  • Domain matching is now case-insensitive.

Please reach out to LoginRadius Support for any further queries.