TillAuth, in order.

v0.6 — July 2026 · The API becomes a product

• The end-user /v1 surface is now specified as OpenAPI 3.1 and served by the API itself (auth.tilldev.dev/openapi.json), with a CI drift-guard: a documented route that doesn't exist fails the build.
• Embedded account settings: your own settings screen can call the same API the hosted pages use — set/change password, passkeys, TOTP — from any registered origin with the user's bearer token. Server-side invariants (policy, step-up, the credential floor) cannot be weakened by a client.
• Password-less accounts (magic-link / OAuth-born) set a first password from a signed-in session — no mailbox round-trip. Step-up-gated when a second factor exists.
• Counter-locked passkeys are recoverable: unlock after a device restore, or remove one you don't recognise. Locked passkeys never count toward sign-in.
• The credential floor: removing a last way in — or a last second factor on an MFA-required app — is refused with a stated reason and next action. Dashboard policy changes that would strand existing users are rejected with the affected count.
• Workers/edge verification documented: @tillstack/auth-node is jose on Web Crypto — runs on workerd/Deno/Bun unchanged, including a fetch-native cookie proxy.

v0.4 — June 2026 · Per-app admin shell

• App-scoped sidebar at /<org>/auth/<appId>/* — drilling into an app replaces the org nav with App / Users / Sessions / Audit / Providers / Policies, removing the duplicate tab strip.
• Per-app branding editor — logo, accent, hosted-login copy.
• Empty-state landing on /<org>/auth when zero apps exist — pillars, numbered quickstart, single CTA.
• SDK reference index — /docs/tillauth/sdk.

v0.3 — May 2026 · TillDev integration

• Cross-product audit log — TillAuth rows now also surface under the unified /<org>/audit view alongside TillPulse + TillDev cross-product events.
• Module-aware org settings — TillAuth's settings group only appears when the module is enabled.
• Post-signin smart redirect — orgs whose only configured product is TillAuth no longer land on an empty TillPulse dashboard.
• Onboarding now picks a product before walking through setup.

v0.2 — April 2026 · OAuth + SSO

• OAuth · Google + GitHub per app — client IDs stored per-app, secrets encrypted at rest.
• OIDC SSO — JWKS-verified id_token, optional allowed-domain gate.
• Secret rotation — per-app secrets re-encrypted at rest in one atomic transaction.
• Custom domains — auth.your-domain.com via customer DNS.
• Breaking: the verify() server SDK return shape adds identities[]. Existing destructures keep working; new field is optional.

v0.1 — March 2026 · Spine

• Email + password — modern, memory-hard password hashing (Argon2id), progressive lockout.
• Passkeys — WebAuthn primary and 2FA, with counter-regression theft detection.
• TOTP + backup codes — first-class, on every plan.
• Magic links — IP-prefix bound, redirect allow-list checked.
• Sessions — refresh-token rotation with theft detection.
• Webhooks — signed and replay-protected, exponential-backoff retries.
• Audit log — append-only, stable action vocabulary, 365-day retention.
• @tillstack/auth-react and @tillstack/auth-node at 0.1.

Looking for another product? See the TillShield and TillForge changelogs, or the TillPulse changelog. The full TillDev shipping log lives at/changelog for now — a unified cross-product log is on the roadmap.