v1.4.0

This version brings us one step closer to resolving issue #3344. We are actively working on a backward-compatible solution for authorization.

Below are some articles that demonstrate how to use Logto as an OAuth or OIDC Identity Provider:

• Streamline OAuth and OIDC Authentication with Logto
• Implement ChatGPT plugins user authentication with Logto
• Simplify Outline authentication with Logto

Feature updates

Introducing the "Always issue Refresh Token" configuration for web apps

Turning on this toggle ensures that Refresh Tokens are always issued, regardless of whether prompt=consent was included in the authorization request or if offline_access was specified in the scope.

Patch updates

• Improved compatibility by parsing requests with application/json content-type for /oidc APIs.
• Automated synchronization of trusted social email and phone information for newly registered users, irrespective of the sign-up identifier configuration.
  • For example: Previously, if the "email" was not set as a sign-up identifier (meaning a valid email connector had to be configured and enabled) and Google sign-in was added, the emails from new users would not be synchronized.
  • Starting from v1.4.0, this requirement has been removed, as "social sign-in only" scenarios are not uncommon in real-world cases.