LoginRadius

No entries match these filters. Clear filters

1. changelog Oct 30, 2026 · issue 125

   LoginRadius adds Phone ID management to the Admin Console user editor⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Add, update, or remove a user's Phone ID directly from User details > Edit User Info — the field appears only when phone login is enabled, and changing it marks the Phone ID as unverified.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Restrict view-only users from creating or editing items in Organizations and Custom IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. > Settings.
   • Add, update, or remove a user's Phone ID directly from User details > Edit User Info — the field appears only when phone login is enabled, and changing it marks the Phone ID as unverified.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

2. changelog Oct 22, 2026 · issue 116

   LoginRadius adds DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. token binding, per-IP rate limiting, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. registration controls, and default Advanced Audit Logging V2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds DPoP (RFC 9449) support to bind Access Tokens and Refresh Tokens to the client's private key, preventing reuse of stolen tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds per-IP rate limiting for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms., OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user., and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.), Account Management, and Partner IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. APIs.
   • Adds server-side checks to block duplicate Passkey registrations and enforce a per-account Passkey count limit.
   • Enables Advanced Audit Logging (V2) and Team Audit Logs V2 by default for new Trial and Enterprise tenants.
   • Adds lrcontent.com to the default allowed callback domains.

   +2 more show less

   • Increases Passkey verification challenge timeout from 1 minute to 3 minutes and enforces single-use, expiry-checked challenges to block replay attacks.
   • Improves JSON processing speed for registration, profile update, and workflow requests.
   • Adds DPoP (RFC 9449) support to bind Access Tokens and Refresh Tokens to the client's private key, preventing reuse of stolen tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds per-IP rate limiting for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms., OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user., and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.), Account Management, and Partner IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. APIs.

   5 more in Everything

3. changelog Oct 12, 2026 · issue 104

   LoginRadius V3JS adds component-level config, RBARBARisk-Based Authentication, an approach that adjusts login challenge strength based on contextual signals like location or device, letting cyber tools step up verification only when anomaly scores cross a threshold. Email OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. challenges, and extended localization keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Show or hide specific auth components per flow — e.g. hide social login on a step-up auth screen without duplicating page templates.
   json copy

   componentConfig: {
     socialLogin: { show: false },
     emailOtp: { show: true }
   }

   Add translated strings for the RBA Email OTP challenge screens to support a localized deployment.
   json copy

   "rba-email-otp": {
     "title": "Verify Your Identity",
     "instruction": "Enter the code sent to your email.",
     "submit": "Verify"
   }

   • Adds componentConfig to the V3JS library to dynamically show or hide specific authentication components per flow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds rba-email-otp localization keys for Risk-Based Authentication Email OTP screens.
   • Extends preventVerificationEmail support to Mandatory Email Verification flows in the Registration Flow.
   • Suspicious sign-ins now trigger an Email OTP challenge via Risk-Based Authentication rather than returning an error.
   • Adds dedicated error-code mapping for Hosted Pages Email OTP verification.
   • Adds componentConfig to the V3JS library to dynamically show or hide specific authentication components per flow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds rba-email-otp localization keys for Risk-Based Authentication Email OTP screens.
   • Adds dedicated error-code mapping for Hosted Pages Email OTP verification.

   2 more in Everything

4. V3 JS Release v3.0.4 Oct 5, 2026 · release notes

   LoginRadius V3 JS v3.0.4 adds componentConfig for dynamic UI control and RBARBARisk-Based Authentication, an approach that adjusts login challenge strength based on contextual signals like location or device, letting cyber tools step up verification only when anomaly scores cross a threshold. email OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. support

   • Adds componentConfig to dynamically show or hide specific authentication components per flow
   • Adds rba-email-otp localization keys for Risk-Based Authentication Email OTP screens

   2 details in Everything