LoginSign Up
← Back to all sparks
F

FusionAuth

DEVOPS
Velocity2.5

Developer-focused authentication, authorization, and user management platform available self-hosted or cloud-hosted

fusionauth.io ↗

FusionAuth adds RFC 8707 resource-scoped tokens while most recent changelogs surface only upgrade boilerplate.

authenticationidentityoauthsecurityopen-source
◆Current state
FusionAuth's changelog data is thinly populated — most entries show only the standard upgrade recommendation with no detailed content. The substantive releases are 1.67.0 (RFC 8707 resource indicators for OAuth tokens, enabling per-resource audience scoping in the `aud` claim) and 1.66.0 (webhook endpoint security hardening requiring global API keys, a breaking change). FusionAuth is an open-source, self-hosted identity platform in consistent quarterly release cadence.
◆Where it's heading
RFC 8707 implementation and the webhook endpoint security hardening both point toward a standards-compliance and security posture focus rather than surface feature expansion. The breaking change in 1.66.0 prioritizing security correctness over backward compatibility signals a product that prioritizes operational security for self-hosters. Version naming with code names (Intelligent Kamfa, Tenant Manager SSO Tasmanian Mountain Skink) is purely cosmetic.
◆Prediction
Standards compliance is the clearest trajectory — RFC implementations tend to cluster. FAPI 2.0 or OAuth 2.0 Rich Authorization Requests are likely candidates given the resource-scoping direction in RFC 8707.

◆Recent moves

  1. 15d ago

    FusionAuth 1.69.1

    Maintenance release with no visible changelog detail in the scraped content — likely a patch for 1.69.0.

    View source ↗
  2. 1mo ago

    FusionAuth 1.69.0

    Version 1.69.0 release with no visible feature detail in the changelog data — content not captured in this data source.

    View source ↗
  3. 2mo ago

    FusionAuth 1.68.0

    Version 1.68.0 (Intelligent Kamfa) release with no visible feature detail in the changelog data.

    View source ↗
  4. 3mo ago

    FusionAuth 1.67.1

    Maintenance release 1.67.1 with no visible changelog detail.

    View source ↗
  5. 3mo ago

    FusionAuth 1.67.0: RFC 8707 resource scoping for tokens

    RFC 8707 resource scoping lets applications constrain OAuth tokens to specific resource URIs via the `resource` parameter, with scoping visible in the `aud` claim — meaningful for multi-resource architectures where token audience isolation matters for security.

    View source ↗
  6. 4mo ago

    FusionAuth 1.66.0: webhook endpoints require global API key

    A breaking change in 1.66.0 requires global API keys for webhook endpoints — closing a security gap where tenant-scoped keys could access installation-wide webhook configuration. Teams using tenant-scoped API keys for webhook management need to migrate before upgrading.

    View source ↗