Ory Network, Ory Kratos v26.1.13 released

Ory Network

Passkey support for API flows

Ory Network now supports passkey registration, login, and settings management through API flows. This enables passkey authentication in mobile apps through native frameworks such as React Native, Swift, and Kotlin.

Add CAPTCHA support to recovery and verification flows

Extends CAPTCHA widget integration to include the self-service verification and recovery flows. This aligns security capabilities with existing login and registration implementations.

Add URL scheme validation for callback and redirect URLs

In Ory Network callback and redirect URLs (...default_browser_return_url), we now only allow for http:// and https://, or empty schemes.

Additional Events Emitted During Onboarding Portal Usage

We now emit events when a project is updated via an onboarding portal link. We emit one event for the project update, as well as one event per SCIM client, OIDC and SAML provider added, deleted or updated.

You can now monitor the following actions within your project’s event stream:

• Onboarding Portal Links: Events are now generated when a link is created, updated, or deleted.

• SSO Providers: Events are now generated when SAML and OIDC providers are created, updated, or deleted.

• SCIM Clients: Events are now generated when SCIM clients are created, updated, or deleted.

These events contain the specific provider ID as well as the organization ID and the concrete onboarding portal link that was used to perform the update.

This is now available on Ory Network.

Ory Kratos

Passkey support for API flows

Kratos now supports passkey registration, login, and settings management through API flows. This enables passkey authentication in mobile apps through native frameworks such as React Native, Swift, and Kotlin.

Add CAPTCHA support to recovery and verification flows

Extends CAPTCHA widget integration to include the self-service verification and recovery flows. This aligns security capabilities with existing login and registration implementations.

Add URL scheme validation for callback and redirect URLs

In Kratos callback and redirect URLs (...default_browser_return_url), we now only allow for http:// and https://, or empty schemes.

This is now available for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Hydra, Ory Keto, Ory Oathkeeper, Ory Polis, and Ory Elements

No significant changes in this release.