v4.24.0

Added

• feat: enforce IPSIE session_expiry ceiling on enterprise connections #2708 (Piyush-85)

v4.23.1

Fixed

• fix: adding example for CTE & CTE impersonation & delegation #2692 (Piyush-85)
• fix: forward state param to OIDC end-session URL in handleLogout #2728 (Piyush-85)
• fix(mtls): revoke refresh token on logout and fix interactive flow routing #2727 (Piyush-85)

Security

• fix: persist per-request max_age in TransactionState to enforce auth_… #2707 (Piyush-85)

v4.23.0

BREAKING CHANGES

• fix: surface MfaRequiredError from passkeyGetToken and passwordlessVe… #2702 (Piyush-85)

Added

• feat(mTLS): example #2695 (Piyush-85)
• feat(mTLS): add mTLS flow tests #2648 (Piyush-85)
• feat(mTLS): add mTLS support to Auth0Client public API #2647 (Piyush-85)
• feat(mTLS): Add Mutual TLS (mTLS) authentication to AuthClient #2646 (Piyush-85)
• feat(mTLS): add MtlsError and MtlsErrorCode #2645 (Piyush-85)
• feat: cte delegation #2690 (Piyush-85)
• feat: add predicate function parameter to allow selectively rolling s… #2622 (PSoltes)

Fixed

• fix: do not add trailing slash to path-based issuer URLs #2693 (sleitor)
• fix: add pnpm-workspace.yaml with allowBuilds to unblock pnpm install… #2701 (Piyush-85)

v4.22.0

Added

• Passkey example and docs update #2678 (Piyush-85)
• Passkey enroll implementation (myaccount) #2680 (Piyush-85)
• Passkey client logic implementation #2677 (Piyush-85)
• Passkey server logic implementaion #2676 (Piyush-85)
• Passkey types & errors #2675 (Piyush-85)

Fixed

• fix: allow path-based domain URLs for Okta custom authorization servers #2666 (sleitor)

v4.21.0

Added

• feat: allow-list auth0-client header for forwarding #2668 (tusharpandey13)
• feat(passwordless): passwordless example #2634 (Piyush-85)
• feat(passwordless): add client-side passwordless module #2633 (Piyush-85)
• feat(passwordless): Add Next.js route handlers for passwordless flows #2608 (Piyush-85)
• feat(passwordless): add passwordlessStart and passwordlessVerify to AuthClient #2607 (Piyush-85)
• feat(passwordless): add error classes and types for passwordless authentication #2606 (Piyush-85)
• feat(passwordless): add connection, screen_hint, login_hint to AuthorizationParameters #2605 (Piyush-85)

Fixed

• fix(cookies): include Secure/SameSite/HttpOnly on deletion Set-Cookie… #2651 (Piyush-85)

v4.20.0

Added

• feat: support customizing profile and accessToken routes #2451 (eliw00d)

Fixed

• fix: stale session reuse on proxy DPoP nonce retry #2582 (nandan-bhat)
• fix: move NextResponse-dependent buildEnrollOptions to server-only module #2643 (sleitor)
• fix: delete v3 appSession cookie on logout #2552 (gmurphey)
• fix: respect allowInsecureRequests option in AuthClientProvider domain validation #2630 (sleitor)

v4.19.0

v4.19.0 (2026-04-22)

Added

• feat: add mfa.stepUpWithPopup() for reactive MFA step-up via Universal Login #2524 (tusharpandey13)

Fixed

• fix: MFA http contract parity fixes #2555 (tusharpandey13)
• fix: skip MCD session backfill in static mode #2618 (tusharpandey13)

v4.18.0

Added

• Reapply feat: add optional update() to SessionDataStore (#2590) #2616 (Piyush-85)

Fixed

• fix: DPoP nonce retry race issue #2580 (nandan-bhat)

v4.17.1

Fixed

• fix: defer AuthClientProvider construction when AUTH0_DOMAIN not set at build time #2604 (sleitor)
• fix: Next.js edge runtime build error for crypto module #2564 (Piyush-85)

v4.17.0

Release v4.17.0 (minor release)

Added

• feat: MCD (Multiple Custom Domains) Support #2545 (tusharpandey13)

Fixed

• fix: prevent rolling session from re-creating a deleted session on concurrent logout #2530 (sleitor)