Changelog

Track platform and SDK releases. This page is generated from the repository CHANGELOG.md. Per-package notes are maintained by Changesets under each SDK folder (for example @wocha/sdk).

Current published SDK line: 0.1.0 (linked @wocha/* packages).

Subscribe via RSS.

[Unreleased]

Added

• Organisation invites: POST /organisations/:id/invites with hosted /invite first-password flow, optional product-owned mail (send: false), and TOTP before return_to
• Silent recovery: POST /users/:id/recovery with send: false returns recovery_link; hosted /recovery preserves return_to
• Public docs: Organisation invites, invite API, and user recovery API
• SDK error messages include documentation links (docsUrl and Docs: in error output)
• Error reference pages at docs/errors/ with hyphenated URLs for docs.wocha.ai
• npm status badges on SDK README files
• Public status page at docs/status/
• scripts/check-strict.sh — verifies TypeScript strict mode across SDK packages
• Interactive API reference (Scalar) at docs/api-reference/
• llms.txt and llms-full.txt for AI agent discovery
• Agent skills for Cursor and Claude Code

[0.1.0] - 2026-06-11

Initial public release of the Wocha auth platform.

Added

SDKs

• TypeScript (@wocha/sdk) — server-side Management API client for Node.js
• Next.js (@wocha/nextjs) — App Router integration with server-side BFF, session handling, and DPoP support
• React (@wocha/react) — SPA integration with PKCE and org switching
• Vue (@wocha/vue), Nuxt (@wocha/nuxt), Remix (@wocha/remix), SvelteKit (@wocha/sveltekit), Angular (@wocha/angular)
• React Native (@wocha/react-native) — mobile OAuth with deep-link callbacks
• Express (@wocha/express) — JWT validation and permission middleware
• UI (@wocha/ui) and shadcn (@wocha/shadcn) — themed and copy-paste auth components
• Testing (@wocha/testing), MCP (@wocha/mcp), skills (@wocha/skills)
• Python (wocha) — Management API client
• Go (wocha-go) — Management API client
• CLI (@wocha/cli) — project scaffolder with framework detection and OAuth auto-provisioning

Customer API

• Management endpoints for users, organisations, OAuth applications, products, connections, actions, API keys, token rules, webhooks, permissions, billing, branding, sessions, and logs
• API key authentication with scoped access and IP allowlisting
• Idempotency keys on mutating requests
• Rate limiting with standard X-RateLimit-* headers
• Offset and cursor pagination

Authentication

• Hosted login UI with per-tenant branding and custom domains
• Social login (Google, GitHub, Microsoft)
• Enterprise SSO via SAML and OIDC
• Multi-factor authentication (TOTP, WebAuthn)
• OAuth 2.1 with PKCE, refresh token rotation, and M2M client credentials
• DPoP (RFC 9449) support in the Next.js SDK

Multitenancy and permissions

• Hybrid tenancy: shared (RLS) and dedicated (schema-per-tenant) isolation models
• Organisation hierarchy with membership and org switching in tokens
• SpiceDB relationship-based access control with permission checks and relationship management

Webhooks

• Event subscriptions with signed deliveries (HMAC-SHA256)
• Configurable retry behaviour and delivery logs

Extensibility

• Custom Actions — sandboxed JavaScript hooks with triggers, deployment, secrets, and test execution
• Token Rules — declarative JWT claim customisation without code

Enterprise

• SCIM 2.0 provisioning endpoints
• Enterprise connection management (SAML/OIDC) via the Customer API

Documentation

• Getting started guide, SaaS and internal integration paths
• Migration guides from Auth0, Clerk, and WorkOS
• Architecture documentation, ADRs, and operational runbooks
• Framework quickstarts for Next.js and React