Flexible sign-in, smarter billing

Sign-in flexibility improvements

Email + password sign-in can now offer a one-time email code as well. Enable Sign in with a code on the password connection, and users who reach the password screen can request a code instead of entering their password - without leaving the flow. That gives you password as the default, with a passwordless fallback for people who have forgotten it or would rather not use one. This feature is currently in beta – please contact support to request access.

Several other updates make sign-in more consistent: businesses can now pin new users to a specific registration method (like email + code) without changing how existing users sign in, faceless auth correctly keeps users on the password/code screen instead of misrouting them to set a password, credential enumeration protection now covers the username/password flow, and sign-in email fields now correctly trigger password manager autofill suggestions.

Block sign-ups from disposable email addresses

You can now turn on a policy to block sign-ups from disposable or throwaway email domains, helping prevent inflated user counts and abuse from single-use identities. The check runs against a Kinde stored, weekly-refreshed list of disposable email domains for fast, reliable enforcement, and is applied only to genuine account creation - invitations, admin/API-created users, and existing sign-in flows are unaffected. Turn it on from your environment's authentication settings.

Annual and mixed-interval pricing

Your customers can now switch to annual pricing directly from the customer portal, not just at sign-up, and plans that mix annual and monthly fixed charges now display correctly instead of being collapsed into misleading monthly totals. Admins can also preview annual pricing while setting up plans, and a new "next invoice" preview shows licensed charges due next plus metered usage so far across portal, sign-up, and admin surfaces.

Automatic tax collection with Stripe

You can now turn on automatic tax collection at the account level, with an optional per-plan override, so Stripe subscriptions are created and updated with the correct tax settings. Kinde intelligently seeds a resolvable tax location from the end user's IP or your Stripe account's registered address when needed, then promotes the actual card billing address once payment is confirmed so future invoices tax correctly.

Shared features and charges made explicit

When a feature or charge is reused across multiple plans, Kinde now clearly shows this with warning banners and "shared" badges wherever you edit it, so you know changes will affect every plan using that item. You can now also edit a shared charge's name directly, and form fields like selects, switches, and pricing tiers no longer lose their values if a save attempt fails validation.

Billing Management API enhancements

There's a range of billing API improvements this cycle: you can now cancel a billing agreement directly via the Management API, listing agreements now requires a customer_id for consistency and performance, and agreements returned from the API include their current billing period. There's also a new endpoint to programmatically create user (family) billing customers, organization and user name changes now automatically sync to your billing provider, end-user access tokens correctly include trial claims again, and the Account API now falls back to organization entitlements when a user has no personal billing plan.

OTP code in email subject line

You can now turn on a setting to include the one-time passcode directly in the verification email's subject line, making it easier for users to sign in from notification previews or lock screens without opening the email.

Minor fixes and improvements

• Webhooks now accept loopback URLs (e.g. localhost) for local development testing when enabled via configuration

• Webhook deliveries returning any 2xx status code are now correctly treated as successful, reducing unnecessary retries and duplicate deliveries

• Added Management API endpoints to count active users and total users holding a specific organization role

• Fixed hosted auth pages darkening unexpectedly

• Fixed inbound LogoutRequest signature verification to use the SP's signing certificate instead of its encryption certificate, so SPs with separate signing/encryption keys are no longer rejected

• Added support for SP signing certificates so signing and encryption certs are stored and used independently

• Scoped "bare" SLO notifications (e.g. from Google Workspace) to end only the specific app's session rather than a user's entire portal session

• Fixed a bug where updating a connection with MCP SSO enabled incorrectly failed validation

• Opening and closing dialogs, and navigating between pages in a section like Settings, no longer resets your scroll position - so you can keep working right where you left off instead of scrolling back down every time.

• The enterprise SSO sign-in button now supports three visibility states (auto/show/hide) instead of a simple on/off toggle, giving you finer control across the widget, custom auth pages, and legacy login.

• For Microsoft Entra ID the unnecessary User.Read scope is now correctly omitted for connections created before the extended-profile setting existed, preventing Conditional Access sign-in blocks.

SDKs

Here's some other changes to SDKs:

• Terraform provider is live. Manage your Kinde configuration as code. First release is up on GitHub — go break it and tell us what's missing.

• PKCE JS SDK: Fixed token refresh reliability, including expired token handling, cookie mode support, and cross-tab synchronization

• React SDK: Added SwitchOrgLink component and switchOrg context method to switch a user's active organization without requiring re-login

• NextJS SDK: Fixed auth route prefetch response and upgraded Next.js to patch a security vulnerability

• Android SDK: Token management decoupled from Activity lifecycle with a new application-scoped KindeClient, plus fixes for stuck logout and refresh token issues

• PHP SDK: Added Management API support for application access roles, organization role user counts, and user billing, plus expanded application settings and a Guzzle security update

• Python SDK: Fixed a security vulnerability in cryptography dependency and regenerated the management SDK from the latest API spec

• React Native SDK: Updated dependencies including jwt-decode v4 and @kinde/js-utils 0.32.0, plus upgraded tooling (TypeScript, Jest, Prettier, Husky)

• TypeScript SDK: Updated @kinde/js-utils dependency to v0.32.0 with tooling and dependency updates

• Java SDK: Updated dependencies including Jackson, Nimbus OAuth 2.0 SDK, OkHttp, Guava, Kotlin, and Netty to their latest versions

• Management API SDK: Upgraded openapi-ts and regenerated SDK with the latest Kinde Management API specs, plus dependency updates

• Remix SDK: Updated dependencies and tooling, including TypeScript, Vite, and ESLint upgrades, with no customer-facing feature changes

• Go SDK: Regenerated Management API client with many new endpoints and stricter connection option validation

• JWT Decoder SDK: Updated dependencies and patched a security vulnerability in vite

• Webhook SDK: Updated @kinde/jwt-validator dependency to fix JWT validation issue

• JWT Validator SDK