April 2026 Summaries

FusionAuth's release of version 1.65.0, whimsically named the Tenant Manager SSO Tasmanian Mountain Skink (TMS TMS), introduces a variety of new features and improvements, enhancing user and administrator experience. The update includes a self-service single sign-on (SSO) solution for Tenant Manager, allowing tenant administrators to configure and test SSO independently, supported by a new Identity Provider Testing API. It also offers customization options such as uploading custom favicons for hosted login pages and introduces a voice option for multi-factor authentication (MFA) to improve accessibility. Additionally, the release simplifies user identity reconciliation through attribute mappings, adds a self-service feature for completing incomplete user registrations, and allows filtering of audit logs by tenant for more efficient debugging. The update also focuses on performance enhancements, including improved multi-node cluster performance, and resolves numerous bugs, mirroring the Tasmanian mountain skink's bug-eating prowess.

The keynote highlighted the challenges and advancements in agent governance, particularly emphasizing the importance of integrating governance into autonomous systems from the outset rather than as an afterthought. A live demonstration at the event revealed the limitations of current systems when Google's Simulator Agent encountered a context token limit, leading to a public failure that underscored the unpredictable nature of Large Language Models (LLMs) and the need for robust governance frameworks. Google's innovations, such as Agent Identity and Agent Gateway, were showcased as solutions to enforce identity and access management (IAM) policies across agents. However, the lack of cross-vendor identity validation remains a critical issue, especially in multicloud environments where different platforms do not natively federate credentials. This fragmentation mirrors historical challenges in user identity across web and mobile platforms, with standards eventually emerging to address these issues. The discussion pointed out the rapid pace of change in the industry, necessitating adaptable architectures that can handle vendor shifts without being locked into a single ecosystem. Solutions like FusionAuth aim to address these challenges by offering a vendor-neutral identity layer that supports machine-to-machine OAuth and fine-grained authorization independent of specific cloud IAM systems.

At Google Cloud Next, the focus was on governance and managing the chaos of deploying AI agents, with Google's Gemini Enterprise Agent Platform offering a comprehensive stack for agent identity and governance. Google emphasized "governance at machine speed," ensuring agents have unique cryptographic IDs, defined authorization policies, and traceable audit trails, addressing issues of unauthorized models, or "shadow AI." Google acquired cloud security firm Wiz for $32 billion to enhance visibility and control over AI applications, highlighting the need for proactive security measures as exploits can occur before patches are available. The urgency of establishing robust identification and authorization processes before AI agents gain access was underscored, as current security infrastructure struggles to keep pace with the rapid development and deployment of AI technologies.

In September 2025, a significant supply chain attack compromised popular npm packages, leading to potential cryptocurrency theft and highlighting vulnerabilities in JavaScript applications regarding token storage. This incident underscores the importance of secure authentication practices, particularly for applications handling sensitive data. The OAuth 2.0 for Browser-Based Applications draft outlines three architecture patterns to manage authentication, with the Backend-for-Frontend (BFF) pattern emerging as the most secure, as it keeps tokens on the server side, away from the browser's reach. BFF architecture treats the browser as a hostile environment, ensuring that tokens are never exposed to potentially compromised JavaScript by using a backend to manage OAuth tokens securely. This method involves storing tokens on the server and using httpOnly cookies to manage sessions, thereby protecting against various attacks such as token theft and cross-site scripting. Although implementing BFF can add complexity and potential latency, it provides significant security benefits, making it a crucial consideration for applications that handle sensitive data. The use of BFF also facilitates centralized logging, monitoring, and easier integration with legacy systems, making it appealing beyond its security advantages. FusionAuth offers a Hosted Backend to simplify the implementation of this architecture, allowing developers to focus on building applications without worrying about underlying security concerns. The decision to adopt BFF should be guided by the sensitivity of the data handled, compliance requirements, and the control over backend operations.

FusionAuth 1.65.0 introduces a self-service SSO configuration flow, addressing the challenges faced by B2B SaaS companies in managing Single Sign-On (SSO) requests from enterprise clients. Traditionally, handling SSO configurations involved cumbersome back-and-forth interactions between engineering teams and client IT admins, resulting in time-consuming processes and potential misconfigurations. This update allows enterprise customers to independently configure their identity providers using either SAML v2 or OIDC, drastically reducing engineering involvement and cutting operational costs. FusionAuth's pricing model further supports scalability by offering flat-rate licensing for SSO connections, avoiding the unpredictable costs associated with per-connection or plan-tier pricing models found in other platforms. Additionally, FusionAuth uniquely offers a single-tenant deployment option, accommodating industries like finance and healthcare with data sovereignty requirements. This positions FusionAuth as a compelling choice for enterprises seeking efficient and cost-effective SSO solutions.

FusionAuth FGA by Permify introduced a Bulk Check API endpoint in December 2025 to streamline the process of verifying user permissions across multiple resources, significantly reducing latency and network overhead compared to individual checks. This new feature allows for up to 100 permissions to be verified in a single API call, enhancing efficiency when needing to display permissions for numerous documents or auditing user access rights. The text uses a schema involving doctors, patients, and medical records to demonstrate the Bulk Check API's application, outlining how permissions for viewing and editing records are assigned based on relationships such as doctor-patient or guardian-child. A practical example is given, showcasing how a hospital administrator can efficiently audit permissions by using a single API call to verify permissions for multiple doctors across various medical records. The Bulk Check API is especially beneficial for complex access controls and batch operations, offering a more optimized approach than traditional single permission checks, while also detailing usage scenarios and potential limitations.

FusionAuth has introduced a Brainf SDK for developers to manage authentication tasks such as login, token refresh, user creation, and registration using a real FusionAuth instance, although it is humorously positioned as a novel and impractical April Fools' joke. The SDK is built using a constrained dialect of C compiled to Brainf via the ELVM toolchain, and it uses a Python bridge to handle network I/O, as Brainf's I/O model is limited. The SDK uniquely employs ASCII control characters from the 1960s for its wire protocol, providing an authentic yet deliberately complex mechanism for HTTP communication. Despite its functional correctness, the SDK's performance is notably slow, requiring substantial CPU resources and time due to the Brainf language's inherent limitations. FusionAuth cheekily acknowledges this project's impracticality for production use, emphasizing its playful nature while also showcasing its technical feasibility.