Everything we shipped in July
B2B Authority and Customer Authority
For teams running partner/B2B access and customer sign-in (CIAM)
Lower OTP costs
If your organization sends a high volume of one-time passcodes to customers, you can save on cost by connecting to your own SMS carrier, like Twilio, Vonage, or TeleSign, and route your OTP traffic through the contract you have already negotiated.
Your costs go down, because the rates you negotiate yourself beat bundled pricing, and at scale that gap can reach six figures a year. Your deliverability goes up, because you can set fallback ordering, so a second carrier steps in when the first one drops messages in a region. And you are no longer tied to whichever provider we picked.
Block attackers from OTP fraud
One-time passcodes attract two costly attack paths: brute-forcing codes, and flooding OTP texts to farm carrier payouts, a trick known as SMS pumping.
SMS sends are now capped automatically, with nothing for you to set up. Our per-user and per-address rate limits control how many OTP attempts or sends happen in a given window, and slow or block anything over the line before it turns into a problem.
More access control for admin access roles
Your configuration APIs now sit behind OAuth2 client-credentials authentication with separate read and write scopes, so access is controlled and auditable like everything else in your environment.
Read access alone can reveal how your environment is wired and write access could let someone change the rules that govern the gateway. Locking both down closes an exposure that penetration tests flag on sight, and it is often exactly what you need to pass a security review. Scoping the two separately means you grant exactly the access each integration needs, and nothing more.
Customer Authority
For customer-facing sign-in and registration experiences (CIAM)
Passkeys are now portable across your brand domains
Roll out phishing-resistant passkeys with confidence. By default, a passkey is scoped to the exact domain a user registers it against. That’s fine for a single site — but if you run more than one property, someone who enrolled on login.yourbrand.com can find themselves locked out on app.yourbrand.com. And if you ever change domains, every user starts over.
With Customer Authority, you can anchor passkeys to your brand domain instead of the host a user happens to land on. That means one credential works across your properties, every rollout starts on the right domain instead of being retrofitted later, and adding a new origin no longer invalidates what users already have. If you’ve ever watched a passkey rollout break in a multi-domain setup, this is the setting that prevents it: no lockouts when users move between your properties.
Workforce Authority
For employee and contractor sign-in across your workforce
Routine, low risk sign-ins are now passwordless
Let the users you already trust skip the password and get straight to work. When the platform scores a sign-in as low risk, based on a known device, a normal location, and recent activity, it removes the password step for that login. Anything suspicious still gets challenged.
Let low-risk users skip the password.
Flexible Dashboard Access
Until now, giving an auditor or SOC analyst a look at the Dashboard meant granting them full admin. If that person got phished, the attacker inherited far more than read access.
Now you can publish the Dashboard as a standalone app scoped to specific datastores, policies, and user groups. This gives the right people read-only visibility without handing out full admin rights, which clears a least-privilege gap that security reviews tend to flag.
Give auditors dashboard access without admin rights.
Native OpenLDAP support
Start using the platform without moving your existing user directory. If you run OpenLDAP (a common system for storing your list of employees and their access), the platform now connects directly to your existing OpenLDAP and uses it as the system of record, reading your users straight from the directory you already maintain. You don’t need a migration project to plan, nor a second copy of your employee data to protect and keep in sync.
Connect your OpenLDAP directory.
Improved sign-in experience for Entra ID users
Get your Microsoft Entra ID users logging in reliably again. In a common Entra ID and Microsoft 365 setup, sign-ins were getting stuck in a loop that bounced users back and forth and locked them out entirely.
How Entra ID users are matched at sign-in.
Our platform can authenticate users against Entra ID directly now, through its token validation endpoint, instead of running a full interactive flow.
How users sign-in without the Microsoft redirect.
Improved login availability
Login availability is something every customer counts on, so we have made the login experience even more resilient. Push, OTP, and biometric flows are more resilient; recovery after restarts is faster, and mobile authentication no longer depends on full-service availability. We also retired legacy components, which reduces the attack surface your audits look at.
Assurance Authority
For risk-based login scoring across your environment
Login scoring at scale
The risk engine now scores logins faster and at higher throughput, returning each decision in milliseconds with capacity tuned for around 20,000 logins per minute. Its pooled connection architecture keeps that speed consistent whether you are running steady traffic or a high-volume surge.
Every single login gets a real-time risk evaluation, even during peak traffic and attack conditions, so no session slips through unscored. For the business, logins stay quick and users get in without delay during your busiest traffic hours.
Resilient risk scoring
We also made the risk engine sturdier. Now, with an enhanced always-on protection scales with you, keeping logins fast and available as you grow and as traffic climbs, without trading security for speed or re-architecting to handle the next surge. The risk engine now evaluates faster and holds that speed no matter how long traffic stays high, keeping its trained model in memory and scoring against it instantly on every login.
Talk to the team → agentic@secureauth.com
Send a feature idea → agentic_ideas@secureauth.com