Releasesby GlyphSuspicious IP Throttling for Custom Token Exchange
We have introduced a Dashboard configuration interface for Suspicious IP Throttling, specifically for Custom Token Exchange. This update allows administrators to easily set thresholds to throttle high-velocity traffic from suspicious IP addresses during the token exchange process.
Also shipped May 19, 2026Okta in May 2026 →
Gemini 3.1 Flash Lite Now Available
gemini-3.1-flash-lite is now available as a managed Google LLM in the Voice Agent API. This Standard tier model replaces the preview version. Set the model in your agent configuration: { "agent": { "think": { "provider": { "type": "google", "model": "gemini-3.1-flash-lite", "temperature": 0.5 } } } }
Deprecations
- gemini-3.1-flash-lite-preview is deprecated and will be removed on May 26, 2025. Migrate to gemini-3.1-flash-lite . For more details on Gemini model deprecations, see Google's Gemini deprecations page . For the full list of supported models and pricing tiers, see the Voice Agent LLM Models documentation .
DigitalOcean Kubernetes (DOKS) now supports single sign-on (SSO) with OIDC in public preview
DigitalOcean Kubernetes (DOKS) now supports single sign-on (SSO) with OIDC in public preview. You can authenticate users to your Kubernetes clusters through an identity provider like Auth0, JumpCloud, Keycloak, or Okta, instead of using …
Screenshot thumbnails for browser checks in Synthetic Monitoring Timepoint Explorer
When debugging browser check failures like “timeout waiting for a selector”, you previously had to rely on text logs alone to understand what the browser rendered. Now, with screenshot thumbnails in the Timepoint Explorer and ad-hoc test panel, you can see exactly what the page looked like at the moment the check ran.
Search volume for AI Visibility [Beta]
Description: AI Visibility now includes Search Volume so you can prioritize topics and prompts based on real demand, not just where your brand appears. Use it to identify high-volume content opportunities and focus optimization where it matters most. Where: Access via AI Visibility → Prompts tab, Topic-level visibility, and When: Open beta, available now.
Cog 0.20.0
New features cog run command. The cog predict command has been renamed to cog run with full backward compatibility. cog predict still works as an alias. ( #3015 ) Model refs for cog push and weights commands. You can now reference models by name (e.g., r8.im/user/model ) instead of full image URLs when pushing or managing weights.
More from Auth0Every Auth0 release →
Non-Unique Emails is Now Generally Available
Non-Unique Emails is now Generally Available (GA) for all Auth0 customers. This feature allows multiple user accounts to share the same email address within a database connection, supporting real-world use cases like families, small businesses, and multi-role users who need separate accounts tied to the same email.
General availability of DPoP sender constraining for Enterprise Connections
Demonstrating Proof of Possession (DPoP) sender constraining for Enterprise Connections is now generally available. Customers can now establish Okta and OIDC Enterprise Connections with DPoP enabled on those connections. This is available on all plans with Enterprise Connections.
Federated Logout for OIDC and Okta enterprise connections is now generally available
Federated Logout is now generally available for OIDC and Okta enterprise connections. When a user logs out with `?federated` appended to the logout URL, Auth0 calls the upstream identity provider's `end_session_endpoint` to terminate the IdP session, closing the gap where a lingering IdP session could silently re-authenticate the user on their next login...
Secure Canonical Domains with New Tenant ACL Signals
We have enhanced Tenant Access Control Lists (ACLs) to provide granular control over upstream proxy infrastructure and canonical domain routing. With this update, you can now isolate traffic by enforcing distinct rules on your canonical hostnames while keeping your user-facing custom domains open. ##### What's New?
Secure your Account API with ACR EA
Auth0's ACR EA release empowers you to secure Account API token issuance by enforcing step-up authentication for sensitive scopes. Whether your users are managing their authentication factors via Universal Login or Embedded flows, you can now gate access through Actions-driven policies or enable a secure-by-default toggle.
Custom Token Exchange - Delegated Authorization now available in Open Early Access
We're excited to announce that __Custom Token Exchange now supports Delegated Authorization__. This release is available to all __Enterprise, B2B Professional, and B2C Professional customers__. Delegated Authorization covers scenarios where a principal (e.g. a human support agent, a backend service, an AI agent) performs actions in the context of a user.
Actions - Access Token Scope Customization - EA
We are excited to announce that we are adding __new Credentials Exchange Actions Access Token Scope Interfaces__ and they are now available in [__Early Access__](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#early-access "Early Access").
Online Refresh Tokens is now in Beta
We are excited to announce that our new feature "Online refresh tokens" is now available to all customers in Beta. This powerful new feature is designed to simplify token management and modernize your application architecture, especially for Single Page Applications (SPAs) allowing you to bind refresh tokens to the sessions they originated from, which...