Skip to main content

v26.1.13

v26.1.13​

Add CAPTCHA support to recovery and verification flows​

Extends CAPTCHA widget integration to include the self-service verification and recovery flows. This aligns security capabilities with existing login and registration implementations.

Add URL scheme validation for callback and redirect URLs​

In Kratos' callback and redirect URLs (...default_browser_return_url), we now only allow for http:// and https://, or empty schemes.

Passkey support for API flows​

Kratos now supports passkey registration, login, and settings management through API flows. This enables passkey authentication in mobile apps through native frameworks such as React Native, Swift, and Kotlin.