## What's new: We've updated session handling in SAML-P and WS-Fed authentication flows to align with industry best practices and our existing OAuth2/OIDC behavior. Following a successful login via SAML-P or WS-Fed, the session ID will now be rotated and a new session cookie will be issued.
We are excited to announce the release of auth0-springboot-api, a new official SDK designed to streamline authentication and security for Spring Boot backend applications.
We’re excited to announce that __Google Workspace Directory Sync for Groups__ is now available in Early Access (EA)! This enhancement enables the automatic and reliable sync of group structures and memberships from Google Workspace directly into Auth0 Enterprise Groups.
Support for sender constraining tokens using Demonstrating Proof of Possession (DPoP) is now generally available on Enterprise plans. Demonstrating Proof of Possession (DPoP) as defined in RFC9449, is an application level mechanism for binding tokens issued by Auth0 to the client application that requested that token.
Boost Passkey adoption by enabling shared enrollment across subdomains. You can now customize the RP ID to allow a single Passkey to authenticate users across multiple applications under the same root domain.Currently in EA Learn more about customizing RP ID for Passkeys: [Configure Passkey Policy...
You can now stream real-time metrics for Auth0 Management API usage and rate limit events directly to your observability platform. These new metric streams give you detailed telemetry on every API request, including success/failure status, specific failure reasons like rate limits, and diagnostic data such as Client ID and request path.
We’re excited to announce that we added new options for __Forms HTTP Vault Connections__! This new set of options allows you to configure different authorization methods for your HTTP Request Flow Actions.
We are excited to announce that __Actions Transaction Metadata__ is now GA. This feature allows you to set, share, and access, custom data between Actions run in the same `post-login` execution.
Releasesby Glyph