# Auth0 Changelog - v202618

## v202618 - added, fixed, updated
*May 27, 2026*

### Actions - Access Token Scope Customization - EA

We are excited to announce that we are adding __new Credentials Exchange Actions Access Token Scope Interfaces__ and they are now available in [__Early Access__](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#early-access "Early Access").

These new interfaces allow you to customize the scopes to be considered when the access token is issued by writing __Credentials Exchange Actions__, considering the restrictions based on API and Client Grants definitions.

__Early Access__ functionality includes:
- __Add/Remove:__ New interfaces to add or remove target scopes from Credentials Exchange Actions.
- __Set/Clear:__ Additional interfaces to clear or set target scopes from Credentials Exchange Actions without having to loop through the list of scopes.
- __Read:__ The list of target scopes becomes available immediately after being transformed.
- __Limits:__ Increased limits to handle up-to 1000 scopes for both __Credentials Exchange Actions__.
- __Bonus:__ The limits were also increased for __Post Login Actions__.
- __Docs:__
  - __Event Object__: [https://auth0.com/docs/customize/actions/explore-triggers/machine-to-machine-trigger/credentials-exchange-event-object#param-target-scopes](https://auth0.com/docs/customize/actions/explore-triggers/machine-to-machine-trigger/credentials-exchange-event-object#param-target-scopes "Event Object") 
  - __API Object__: [https://auth0.com/docs/customize/actions/explore-triggers/machine-to-machine-trigger/credentials-exchange-api-object#api-transaction](https://auth0.com/docs/customize/actions/explore-triggers/machine-to-machine-trigger/credentials-exchange-api-object#api-transaction "API Object")

### Fix for Empty login_hint Parameter on External Identity Providers Requests

__What's Changing:__

We are fixing an issue where Auth0 was including an empty `login_hint` query parameter when redirecting users to external identity providers. Going forward, `login_hint` will only be included in the authorization request when a value is actually present.

__Why This Matters:__ Some external OAuth providers strictly validate request parameters and reject authorization requests that contain empty parameter values. This caused authentication failures for customers whose upstream identity providers do not tolerate empty `login_hint` values — particularly in scenarios where customers do not control the external IdP and cannot modify its validation behavior.

__Rollout Timing:__ This fix will be rolled out progressively over the next 1–2 weeks.

__Action Required:__ No action is required from customers. If you previously implemented a workaround by [overriding connection parameters](https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps#update-the-connection-static-) to suppress the empty `login_hint`, you may optionally remove that override after confirming the fix is active in your environment.

### Support for Private Key JWT assertions and additional signing algorithms on Okta and OIDC enterprise connections.

Private Key JWT assertions and expanded signing algorithm support are now generally available across Enterprise Okta and OIDC Connections.

Private Key JWT assertions deliver enterprise-grade security by leveraging asymmetric cryptography to authenticate against your upstream Okta and OIDC identity providers. You now have full control over which signing algorithms Auth0 uses when generating client assertion JWTs - giving you the flexibility to align with your security standards and existing infrastructure.

We've also expanded ID token verification on enterprise connections to support additional signing algorithms: RS384, RS512, PS256, PS384, ES256, and ES384. This means fewer integration headaches when connecting to upstream identity providers and greater compatibility across your authentication flows.

These capabilities put you in the driver's seat: choose the cryptographic methods that work best for your environment, eliminate integration blockers, and stay ahead of evolving security standards.

Please refer to the [product documentation](https://auth0.com/docs/authenticate/enterprise-connections/private-key-jwt-client-auth).

### Auth0 Event Streams for Outbound User Lifecycle Management – Now in General Availability

Event Streams is now available for all customers in General Availablity.

Customer can:
- Subscribe to Auth0 User, Organizations, and Groups (Early Access Limited Release) Events
- Deliver Events to AWS EventBridge, Auth0 Actions, and Webhooks (including to [Okta Workflows](https://help.okta.com/wf/en-us/content/topics/workflows/execute/flow-api-endpoint.htm "Okta Workflows") via Customer Header Auth)
- Consume events via the Events API

See the [Auth0 Docs](https://auth0.com/docs/deploy-monitor/events "Event Streams") and [Event Catalog](https://auth0.com/docs/events "Event Catalog") for further instructions.

### Enhanced Security Controls for Third-Party Applications is now Generally Available

We're excited to announce that **Enhanced Security Controls for Third-Party Applications** is now Generally Available for all Auth0 customers.

As you open your APIs to AI agents, customers, partners, and external developers, you need strong security defaults for third-party applications. Enhanced security controls give third-party applications a secure-by-default posture, so Auth0 does the heavy lifting, and you stay in control of what external applications can access.

**What's included:**

* **Strict security mode** for third-party applications (`third_party_security_mode: 'strict'`)
* **OAuth 2.1 alignment**: mandatory PKCE, restricted grant types
* **Explicit API authorization**: third-party applications always require a client grant to access an API
* **Default permissions for third-party applications**: configure default API permissions that apply automatically to all third-party applications, including those created via **Dynamic Client Registration**
* **Open redirect protection**: configurable `redirection_policy` to prevent redirect-based attacks
* **Reduced attack surface**: curated property allowlist and feature restrictions

![new-stict-3pa](//images.ctfassets.net/kbkgmx9upatd/42IkAkkH2ACxpxnVseCPh6/f8a79b1675c96d60bb1c995b02c2cf41/new-stict-3pa.png)

**For existing customers using third-party applications**: Your existing applications continue to work exactly as they do today — no changes required. A 6-month migration window gives you time to adopt enhanced security controls for new application creation. Review the [migration guide](https://auth0.com/docs/troubleshoot/product-lifecycle/deprecations-and-migrations/migrate-to-enhanced-security-third-party-applications) for detailed steps.

To learn more, visit the [Third-Party Applications documentation](https://auth0.com/docs/get-started/applications/third-party-applications).

### Organization Discovery by Domain now in General Availability!

We're thrilled to announce that __Organization Discovery by Domain is now in General Availability__! Automatically identify your customers' users and route them to the right identity provider based on their email domain — before they even reach the login screen.

Key Advantages at a Glance:
- Automatic routing: Direct users to their organization's IdP the moment they enter their email — no manual org selection required.
- Multi-org support: When a single domain maps to multiple organizations, an org picker ensures users land in the right place.
- Seamless B2B login: Eliminate the friction of Home Realm Discovery by adding full organization context to the pre-login flow.
- Flexible configuration: Support email-based, org-name-based, or combined discovery to match your customers' login requirements.

To dive deeper, please review our documentation [here](https://auth0.com/docs/manage-users/organizations/login-flows-for-organizations#organization-domain-discovery-optional).

### Self-Service Provisioning now in General Availability!

We’re thrilled to announce that the __Self-Service Provisioning experience is now in General Availability__! Empower your customers' IT teams to handle user onboarding and offboarding themselves, which means less manual work and fewer support tickets for your team.

__Key Advantages at a Glance__
- Automation: Allow your customer's admins to manage their own SCIM setup.
- Interoperability: Ensure seamless integration with a wide variety of customer IdPs.
- Consistency: Use a single, unified schema for easier support and debugging.
- Flexibility: Retain the ability to override attribute mappings for specific protocols if needed.

![User Provisioning](//images.ctfassets.net/kbkgmx9upatd/1sLKLMX9mHZ3fwwnYVtM0p/bf92648b962e8ab7127231222020f59a/SS-SCIM.gif)

To dive deeper, please review our updated documented on [Self-Service Enterprise Configuration](https://auth0.com/docs/authenticate/enterprise-connections/self-service-enterprise-config).

### Self-Service Domain Verification now in General Availabilty!

We're excited to announce that __Self-Service Domain Verification is now in General Availability__! Allow your customers' IT admins to verify their own email domains for HRD directly within the SSO setup assistant — no back-and-forth with your team required.

Key Advantages at a Glance:
- Proven ownership: IT admins verify domains via DNS TXT record.
- Flexible requirements: Configure domain verification as off, optional, or required — per customer engagement.
- Domain management: IT admins can now add, re-verify, and delete domains entirely through self-service.
- Enterprise-ready controls: Pre-configure domains for your customers to verify, or pre-verify domains on their behalf — with verified domains automatically powering Organization Discovery when enabled.

To dive deeper, please review our updated documentation on[ Self-Service Enterprise Configuration](https://auth0.com/docs/authenticate/enterprise-connections/self-service-enterprise-config).

### New Identity, Same Great Features: Self-Service SSO is now Self-Service Enterprise Configuration

The new name better reflects the full scope of the suite, which includes:

- Single Sign-On (SSO): Allow enterprise customers to configure and maintain SSO for their applications.
- Domain Verification: Self-managed domain verification and mapping for IT admins.
- Google Directory Sync: Keep user attributes synchronized across systems.
- User Provisioning: Automate the user lifecycle through SCIM 2.0.

No functional changes — everything works the same. For full details, see the [Self-Service Enterprise Configuration](https://auth0.com/docs/authenticate/enterprise-connections/self-service-enterprise-config) documentation.

---