Public backlog

What we shipped, and what comes next.

Everything in the first column runs in production today. The rest is where we are heading, in the order we expect to get there.

Updated October 1, 2026

Shipped

Live in the API and the console.

SecurityOct 2026
Rotate a client secret, shown once
Revoke a client secret and issue a new one in a single step. The new value is displayed exactly once and never again.
SecurityOct 2026
Realm and client rules enforced at runtime
Password, lockout and token rules come from the realm and client configuration on every request, with nothing left hard-coded in the API.
ConsoleOct 2026
A rebuilt console
Every screen moved to one component kit: lists, records, forms in steps, validation that matches the API, and compact layouts.
ConsoleSep 2026
Redesigned hosted screens
Sign-in, password, consent, device code and the account area, rebuilt to match the console and branded per client.
PlatformSep 2026
MCP and connected accounts by plan
Resource servers, connected accounts and monthly token exchanges are plan features with their own quotas.
MCP & AISep 2026
Audit trail for MCP
Resource, scopes and exchanges recorded on every access log entry, with activity per resource server and per connection.
MCP & AISep 2026
Personal and corporate connections
Organizations decide which connected accounts their members may use, and the MCP server learns which context a connection belongs to.
MCP & AIRFC 8693Sep 2026
Connected accounts and token exchange
A vault for each person’s provider tokens. MCP servers exchange the person’s Auth.io token for a short-lived provider token at the moment a tool needs it.
MCP & AISep 2026
Client ID metadata documents
An MCP client can identify itself with a URL that publishes its metadata, so a realm can accept agents without registering each one by hand.
MCP & AIRFC 8707RFC 7662Sep 2026
MCP servers as resource servers
Register an MCP server with its identifier, scopes, allowed clients and introspection client. Tokens are issued for it alone.
Identity & tenancySep 2026
One user per realm, single sign-on by choice
A person is one account in a realm, and single sign-on between that realm’s clients is switched on per client rather than assumed.
MCP & AISep 2026
Claim mappers drafted by the advisor
Describe the claim you need in a sentence; the advisor drafts the mapper and shows the diff before anything is saved.
SecurityWebAuthn L2Aug 2026
Passkeys
WebAuthn sign-in as a configurable step of a client’s login flow, with devices managed by the user and the administrator.
PlatformAug 2026
Accounts with a team
Invite people to the console with roles, so an account no longer belongs to the one person who signed up.
Identity & tenancyAug 2026
Federation with external identity providers
Sign in through any OAuth 2.0 or OpenID Connect provider, with linking rules and role mapping per realm.
SecurityAug 2026
Refresh token rotation with reuse detection
Each refresh issues a new token and retires the old one. Presenting a retired token ends the whole family and is recorded.

In progress

Being built right now.

Platform
API reorganized around its use cases
Every service moved into a clean application layer behind ports, so new protocol work lands faster and is tested in isolation.
MCP & AI
SDK for MCP servers
The reference MCP server becomes a library: metadata, the 401 challenge, token checks and connected-account exchange in a few lines.
MCP & AI
MCP guide in the docs
A step-by-step guide from an empty realm to an agent calling a tool, including every refusal and what it means.

Up next

Planned, in rough order. Not a date.

Security
Adaptive sign-in protection
Risk rules evaluated at sign-in, such as a new country or a burst of failures from one address, each with its own action: allow, ask for a second factor, or block.
Platform
Realms as code
Export a realm as canonical JSON without secrets, and import it with a dry run that shows the diff before applying it.
Console
Editable e-mail templates
Per-client templates for verification, password reset and sign-in codes, with preview and a test send.
Identity & tenancySAML 2.0
SAML 2.0 providers
Federation with corporate identity providers that speak SAML, alongside the OpenID Connect providers already supported.
Identity & tenancyRFC 7644
SCIM provisioning
Users and groups created, updated and removed by the customer’s directory, so someone who leaves loses access everywhere.

Exploring

Being researched. May change shape, or not ship.

MCP & AIRFC 7591
Dynamic client registration
Let MCP clients register themselves under a realm’s policy, for agents that cannot publish a metadata document.
SecurityRFC 9449
Sender-constrained tokens
DPoP binds a token to a key the client holds, so a stolen token is useless on its own.
Platform
Log streaming to your SIEM
Access and audit logs delivered continuously to your own storage or security tooling, with your own retention.
Platform
Terraform provider
Realms, clients, scopes and resource servers managed from the same pipeline as the rest of your infrastructure.

Missing something?

Tell us what would make Auth.io the obvious choice for your team. Requests from customers are what move entries between columns.

Suggest a feature

What we shipped, and what comes next.

Shipped

Rotate a client secret, shown once

Realm and client rules enforced at runtime

A rebuilt console

Redesigned hosted screens

MCP and connected accounts by plan

Audit trail for MCP

Personal and corporate connections

Connected accounts and token exchange

Client ID metadata documents

MCP servers as resource servers

One user per realm, single sign-on by choice

Claim mappers drafted by the advisor

Passkeys

Accounts with a team

Federation with external identity providers

Refresh token rotation with reuse detection

In progress

API reorganized around its use cases

SDK for MCP servers

MCP guide in the docs

Up next

Adaptive sign-in protection

Realms as code

Editable e-mail templates

SAML 2.0 providers

SCIM provisioning

Exploring

Dynamic client registration

Sender-constrained tokens

Log streaming to your SIEM

Terraform provider

Missing something?