LoginWith LoginWith Docs

Changelog

What changed in the LoginWith API, SDKs, hosted pages and MCP, newest first.

Changes that affect what you integrate against or what your users see, grouped by week. Breaking changes are marked Breaking.

Week of October 12, 2026

  • Site — The site and these docs moved from loginwith.app to loginwith.dev. Old loginwith.app links redirect to the same path on loginwith.dev.
  • Hosted pages — Pages that pointed at LoginWith’s own policies now link to them on loginwith.dev.
  • SDK — @loginwith-official/sdk’s server client now defaults to the issuer https://{org}.loginwith.dev/. It previously defaulted to a loginwith.app host and rejected valid tokens. See Server & API SDKs.
  • Custom domains — Your organization adds a custom domain and proves it owns it with a DNS TXT record. A page can only use a verified domain of its own organization. See Custom domains.
  • Console — A new Domains screen, and a page’s custom domain is picked from your verified domains. See Custom domains.
  • Hosted pages — Owners can open a page’s in-place editor from the console and edit the live page directly. See Management API.

Week of October 5, 2026

  • OAuth — /oauth/authorize now works for every client of an organization, public or confidential, and discovery publishes authorization_endpoint on every org. Any standard OAuth/OIDC library can integrate with a discovery URL, a client ID and (for confidential clients) a secret. PKCE S256 is required for every client. See Client API.
  • Tokens — Token exchange (RFC 8693): a confidential backend trades a user’s browser token for one issued to itself, with the same session and an azp claim naming the original client. The new token never outlives the original and gets no refresh token. See Tokens.
  • Onboarding — Signing in on an unclaimed <name>.loginwith.page now claims it: that sign-in creates your organization and lands you in the console. See Quickstart.
  • Browser SDK — A script-tag build of the browser client, served at https://<org>.loginwith.dev/cdn/sdk-latest, preconfigured for your org and exposing window.lgw with lgw.signIn(). See Browser SDK.

Week of September 28, 2026

  • OAuth — /oauth/authorize gains the standard OAuth 2.1 authorization-code flow (client first, PKCE S256 required), starting with console-class clients. See Client API.
  • OAuth — Dynamic client registration (RFC 7591) at POST /oauth/register, advertised as registration_endpoint on the console organization. See Client API.
  • Hosted pages — A consent screen: a third-party client must be approved by the user before an authorization code is issued.
  • Discovery — The discovery document is also served at /.well-known/oauth-authorization-server (RFC 8414), the path MCP clients fetch. See Client API.
  • MCP — A hosted MCP server (Streamable HTTP) exposes the management API to AI agents, authenticated with OAuth as a console user. See MCP.

Week of September 21, 2026

  • Clients — Confidential clients: a client can hold a secret (shown once, rotatable) and an IP allowlist. It must present the secret on every grant, via client_secret_basic or client_secret_post, and can use the client_credentials grant for machine tokens. See Client API.
  • Events — Changes and sign-ins are recorded as events in an append-only audit log, readable at GET /organizations/:id/events. See Webhooks & events.
  • Webhooks — Per-organization outbound webhooks, matched by event pattern, signed with HMAC-SHA256 in X-LoginWith-Signature and retried with backoff. See Webhooks & events.
  • Impersonation — An org owner can sign in to an app as one of its users. The token carries an act claim, cannot be refreshed, and every start is logged. See Management API.
  • Members — A tenant admin can manage their own tenant’s roster. See Management API.
  • Breaking: SDK — The JavaScript SDK packages moved to npm under the @loginwith scope (@loginwith/sdk, @loginwith/sveltekit, @loginwith/koa) and restarted at 0.1.0. Update package names and imports.
  • SDK — New @loginwith/sdk, a typed, framework-free client for the authorization server, with optional clientSecret for confidential clients. See Server & API SDKs.
  • SvelteKit SDK — Two modes: /client for browser-only apps and /server for a backend-for-frontend that keeps tokens in an encrypted cookie. The root import still works. See SvelteKit SDK.
  • Breaking: Koa SDK — Verified tokens are now { kind: 'user' } or { kind: 'client' }, and the verifier can accept machine tokens from trusted clients. A token minter for client_credentials is included. See Server & API SDKs.

Week of September 14, 2026

  • Sign-in — New identity providers: GitHub, GitLab, Microsoft, LinkedIn, X, Apple and Meta. Provider sign-ins use PKCE where the provider supports it.
  • Sign-in — Passwordless sign-in by emailed magic link, and password sign-in, with a 12-character minimum password length.
  • MFA — Second factors: TOTP, passkeys, FIDO security keys, email and SMS codes, and backup codes. Enrolled factors are enforced at sign-in.
  • Tokens — Access tokens carry amr (how the user authenticated) and acr (how strongly). See Tokens.
  • Breaking: Users — Users and their sign-in methods now belong to a single organization. The same person signing in to two organizations is two separate users.
  • Users — PATCH /users/me lets a signed-in user edit their own name, and /users/me returns a labels claim with the user’s groups. See Client API.
  • Hosted pages — A hosted profile page where users manage their MFA factors and link other sign-in methods to their account; duplicate accounts are merged. Link to it with profileUrl() in the browser SDK. See Browser SDK.
  • Hosted pages — Login pages can be offered in up to 12 languages, chosen per page, including right-to-left Arabic.
  • Invitations — Invitation emails, and invited users see a “create your account” sign-in with their email prefilled.
  • Email — Sign-in and invitation emails are sent from your organization’s name and address instead of a shared LoginWith sender.

Week of September 7, 2026

  • Console — Sign in to the console and switch between the organizations you administer. See Management API.
  • Management API — Manage tenants (list, create, rename, set a logo, soft-delete), members, clients and pages for your organization, and delete an organization. See Management API.
  • Tenants — Self-serve tenant creation. See Management API.
  • Email — Transactional email with brand kits per template and test sends from the console.
  • Errors — Browser-facing steps of the sign-in flow show an error page instead of a raw error.

Week of August 31, 2026

  • Breaking: OAuth — Sign-in now returns an authorization code in the query string, redeemed at POST /oauth/token, instead of an access token in the URL fragment. See Client API.
  • OAuth — PKCE on the app-initiated sign-in flow. See Client API.
  • Tokens — Refresh tokens, rotated on every use with reuse detection, and session revocation at POST /oauth/revoke (RFC 7009). See Tokens.
  • Discovery — /.well-known/openid-configuration and the OIDC UserInfo endpoint at /users/me. Endpoints require authentication by default. See Client API.
  • Tenants — A user in several tenants picks one at sign-in, and can switch tenant without signing in again via the switch-tenant grant. See Tokens.
  • Users — /users/me reports which provider the account came from.

August 2026

  • Hosted pages — Login pages rebuilt: a method chooser, your branding on buttons, favicon and social tags, and a system/light/dark theme switcher.
  • Hosted pages — Your own policy links show under the sign-in card.
  • Security — The SSO sign-in state is signed and bound to the browser that started it.
  • Security — Redirect URIs and the referring origin are validated before any redirect.