0.20.1 (2026-06-11)

Bug Fixes

• catch lock timeout errors instead of leaking to app (#117) (e31a902)
• harden state and signOut returnTo against untrusted redirects (#122) (138b602)

0.20.0 (2026-03-24)

Features

• support multi-app cookies and scoped storage keys (#114) (c85b7ca)

What's Changed

• Stop unnecessarily setting screen_hint=sign-in by @cmatheson in #107
• Clear session organization on sign out or refresh error by @nholden in #110

Full Changelog: v0.18.0...v0.19.0

What's Changed

• fix: handle signOut() when no session exists by @nicknisi in #104
• v0.18.0 by @nicknisi in #106

Full Changelog: v0.17.0...v0.18.0

What's Changed

• feat: enable npm Trusted Publishers by @nicknisi in #101
• Add authentication method to response interfaces and serializer by @ohjonah in #99

New Contributors

• @ohjonah made their first contribution in #99

Full Changelog: v0.16.0...v0.17.0

What's Changed

• Revert emitting custom event with access token by @chaance in #96

Full Changelog: v0.15.0...v0.16.0

What's Changed

• Emit custom event when token is refreshed by @chaance in #51

New Contributors

• @chaance made their first contribution in #51

Full Changelog: v0.14.0...v0.15.0

What's Changed

• Add roles to JWT payload by @atainter in #93
• v0.14.0 by @atainter in #94

New Contributors

• @atainter made their first contribution in #93

Full Changelog: v0.13.0...v0.14.0

What's Changed

• Add feature_flags claim on jwt interface by @kkajla12 in #89

Full Changelog: v0.12.0...v0.13.0

What's Changed

• Add support for custom claims in getClaims function by @nicknisi in #87

Full Changelog: v0.11.0...v0.12.0

What's Changed

• Remove 'impersonation coming soon' error message by @nholden in #80
• Deprecate context option on getAuthorizationUrl and signIn by @nholden in #83
• Add forceRefresh option to getAccessToken method by @nicknisi in #85
• Improve compatibility with hybrid mobile apps by @vdsbenoit in #84
• v0.11.0 by @nicknisi in #86

New Contributors

• @nholden made their first contribution in #80
• @vdsbenoit made their first contribution in #84

Full Changelog: v0.10.1...v0.11.0

What's Changed

• Add coana-guardrail and coana-analysis workflows by @nicknisi in #74
• Add coana-guardrail and coana-analysis workflows by @nicknisi in #75
• fix: subsequent refreshes by @nananathanh in #78
• v0.10.1 by @nicknisi in #79

New Contributors

• @nananathanh made their first contribution in #78

Full Changelog: v0.10.0...v0.10.1

Added

• Add lastSignInAt to user by @stacurry in #70
• Add externalId to user interface by @faroceann in #72

Full Changelog: v0.9.0...v0.10.0

Added

• Added returnTo option to signOut by (#67)

Fixes

• properly refreshes the session on page load (#66)

Changes

• Avoids initial refresh when user has no session (https://github.com/workos/authkit-js/pull/61)

Fixes

• Throws error instead of returning stale access tokens when offline (https://github.com/workos/authkit-js/pull/63)
• Properly exports OnRefreshResponse type

Changes

• export type OnRefreshResponse

Changes

• onRefresh callbacks no longer receive the refresh token (#58)

Fixed

• Avoids an issue where multiple authentication requests could queue up when multiple getAccessToken calls are made when the token needs to be refreshed.

Added

• switchToOrganization can be used to switch a user's active organization.
• signIn and signUp now take organizationId and loginHint parameters.

Fixed

• Under-the-hood changes to improve the locking and synchronization between tabs during session refresh. (#41)

Added

• Added new refreshBufferInterval option to configure how soon the client will attempt to refresh. (#39)

Changed

Updated console error message with more explanation when a code could not be exchanged due to missing codeVerifier.

Added context parameter to signIn()/signUp().

fixes an issue where we repeatedly attempted to refresh the session after it had already ended.

Changes

• Only proactively refreshes active tabs (inactive tabs will still be refreshed as necessary when getAccessToken is called).
• Doesn't call onRefreshFailure on the initial refresh request

Fixes

• authkit-js would previously return stale tokens after a browser lock error

Removes

• refreshSession (getAccessToken will refresh when necessary)

• Added onRefreshError callback
• Changed: getAccessToken throws a LoginRequiredError if an access token cannot be returned.

Fixes

• refresh timing (#15)

Fixes:

• Schedules token-refreshing after exchanging authorization code
• Calls onRefresh() after successful code exchange response

• Added passwordResetToken option for signIn()