• feat(auth)!: elevate sessions using SMS OTP (#4831)latest12Docse05eec92026-10-30 15:44

  Change detail

  3 changes across 3 operations

  AllBreakingWarningInfo

  • GET/elevate
    • warning

      added the new otp-sms enum value to the methods/items response property for the response status 200

  • POST/elevate/otp/sms
    • info

      endpoint added

  • POST/elevate/otp/sms/verify
    • info

      endpoint added

• feat(auth)!: elevate sessions using email OTP (#4665)12Docs2351c9b2026-10-30 13:41

  Change detail

  3 changes across 3 operations

  AllBreakingWarningInfo

  • GET/elevate
    • warning

      added the new otp-email enum value to the methods/items response property for the response status 200

  • POST/elevate/otp/email
    • info

      endpoint added

  • POST/elevate/otp/email/verify
    • info

      endpoint added

• feat(auth)!: elevate sessions using TOTP (#4612)2Docsd04ab9f2026-10-19 16:19

  Change detail

  2 changes across 2 operations

  AllBreakingWarningInfo

  • GET/elevate
    • info

      endpoint added

  • POST/elevate/totp
    • info

      endpoint added

• fix(docs): align specs with reality (#4632)15Docs6bbecf42026-09-02 13:25

  Change detail

  15 changes across 15 operations

  AllBreakingWarningInfo

  • POST/elevate/webauthn/verify
    • breaking

      the response property session/user/metadata became nullable for the status 200

  • POST/signin/anonymous
    • breaking

      the response property session/user/metadata became nullable for the status 200

  • POST/signin/email-password
    • breaking

      the response property session/user/metadata became nullable for the status 200

  • POST/signin/idtoken
    • breaking

      the response property session/user/metadata became nullable for the status 200

  • POST/signin/mfa/totp
    • breaking

      the response property session/user/metadata became nullable for the status 200

  • POST/signin/otp/email/verify
    • breaking

      the response property session/user/metadata became nullable for the status 200

  • POST/signin/passwordless/sms/otp
    • breaking

      the response property session/user/metadata became nullable for the status 200

  View all changes (15)
• feat(auth): add SMS deanonymization and phone number changes (#4576)3Docsc9342b02026-09-02 10:02

  Change detail

  3 changes across 3 operations

  AllBreakingWarningInfo

  • POST/user/deanonymize/sms
    • info

      endpoint added

  • POST/user/phone-number/change
    • info

      endpoint added

  • POST/user/phone-number/change/verify
    • info

      endpoint added

• feat(auth): add generic upstreamParams passthrough for OAuth2 providers (#4664)2Docsb5e62a42026-07-31 10:57
• 1.0.0no API changesDocs2026-07-17 12:03
• fix(auth)!: require elevated permissions to generate TOTP secret (#4493)2Docs0e9316f2026-06-24 21:56
• fix(auth): hash email OTP, make it single-use, and shorten its TTL (#4421)50Docs395d4262026-06-24 20:51
• fix(auth): revoke all sessions on password change (#4192)no API changesDocs52c70662026-04-30 13:25
• feat(auth): allow disabling auto-signup (#4168)4550Docs4767f452026-04-20 08:26
• feat(auth): added pkce (#4038)10Docs7c12cf52026-03-27 05:37
• feat(auth): added graphql scope support to oauth2's userinfo endpoint (#3942)no API changesDocs02aab262026-02-23 11:49
• feat(auth): added oauth2/oidc provider functionality (#3922)12Docs75172bf2026-02-19 10:12
• feat(auth): change locale so it allows for 3 characters (#3776)1310Docs28bcbf52026-01-13 14:23
• fix(auth): add back support for workos connection/organization on signin (#3731)1Docs1b90b682025-12-18 15:36
• fix(auth): return meaningful error if the provider's account is already linked (#3680)42Docsa3a3cf22025-11-11 11:56
• feat(auth): added endpoints to retrieve and refresh oauth2 providers' tokens (#3614)6Docs51ec1512025-10-28 11:50
• chore(docs): fix broken link in openapi spec and minor mistakes in postmark integration info (#3621)no API changesDocs8c127d72025-10-21 10:32
• Move hasura-auth files into services/auth subdirectory3051145Docs2e097232025-10-09 14:14

Revisions go back to the API's first capture.