loading
Preparing LoginRadius developer resources
Mission: Help enterprises accelerate digital transformation with our fully-managed Customer IAM technology.
Skip to main content

Core API Release 38.5.0

ยท One min read
Subscribe via RSS

This release of the LoginRadius Core API introduces new security enhancements, performance improvements, and a bug fix.

Changelog

Added

  • DPoP support: Added support for DPoP (RFC 9449), which binds Access Tokens and Refresh Tokens to the client's private key to prevent stolen tokens from being reused.

  • Per-IP rate limiting: Added per-IP rate limiting for SSO (OAuth 2.0, OIDC, and SAML), Account Management, and Partner IAM APIs.

  • Passkey registration controls: Added server-side checks to block duplicate Passkey registrations and limit the number of Passkeys an account can have.

  • Default audit logging: Enabled Advanced Audit Logging (V2) and Team Audit Logs V2 by default for new Trial and Enterprise tenants.

Improved

  • Passkey verification: Increased the verification timeout from 1 minute to 3 minutes. Each challenge can now be used only once and is checked for expiry to block replay attempts.

  • Callback domains: Added lrcontent.com to the default allowed callback domains.

  • JSON processing: Improved JSON processing speed for registration, profile update, and workflow requests.

Fixed

  • Forgot Passkey endpoint: Fixed the endpoint so it no longer reveals whether an email address exists when Generic Error is enabled.

Please reach out to LoginRadius Support for any further queries.