What’s New

Added passkey autofill support (WebAuthn Conditional UI), letting users sign in by selecting a passkey from the browser’s native autofill picker.

Added invisible reCAPTCHA v2, invisible hCaptcha, and reCAPTCHA Enterprise support via the captcha configuration option.

Added runtime theming support: pass a theme object to configure({ style: { theme } }) to apply brand colors and fonts without rebuilding the widget.

Added dedicated stages for MFA enrollment and recovery codes, and for the PingOne Advanced Identity Cloud admin registration flow (welcome, OTP verification, and privacy policy acceptance).

Added experimental support for custom callback and stage components, letting you override or extend the widget’s built-in UI. Refer to the Advanced Identity Cloud/PingAM Web Login Framework repository for details.

Added TextInputCallback support.

Migrated the Journey implementation from @forgerock/javascript-sdk to @forgerock/journey-client.

Migrated the OIDC token, userinfo, and logout implementations from @forgerock/javascript-sdk to @forgerock/oidc-client.

Migrated the PingOne Protect implementation from @forgerock/ping-protect to @forgerock/protect.

Migrated the Advanced Identity Cloud/PingAM Login Widget internal build to Svelte 5 and a pnpm monorepo architecture.

Fixed a visual regression in the info alert that showed the wrong background color when runtime theming was active.

Fixed a typo and some grammar issues in the default English locale text.

Fixed an issue preventing ConfirmationCallback options beyond the second from being selectable.

Fixed the passkey prompt appearing twice during WebAuthn sign-in.

Fixed the failureUrl not being exposed in the journey error handler after login failure .

The synchronous configuration() export and its .set() method are replaced by a single async configure() function. await it before calling any other Widget API.

The nested forgerock config object is replaced by a flat, top-level shape. Endpoint discovery is driven by a single top-level wellknown URL, and OAuth settings now live in an oidcClient sub-object.

The request module export is removed. Get tokens from user.tokens().get() and call fetch() with a manual Authorization header.

OAuth/OIDC, user info, and logout are now backed by @forgerock/oidc-client. PingOne Protect is backed by @forgerock/protect. @forgerock/javascript-sdk is no longer a dependency of the widget.

The serverConfig object, realmPath, tree, tokenStore, prefix, logLevel, logger, platformHeader, oauthThreshold, and all serverConfig.paths.* overrides are removed.

Added support for integration with PingOne Protect.

Added the name of the device to the recovery codes page.

Corrected an issue that prevented use of the logLevel parameter in the Advanced Identity Cloud/PingAM Login Widget configuration.

Fixed an issue with configuration literals that caused ZodError messages in the console.

Support for CAPTCHA nodes.

Support for device profiling callbacks (DeviceProfileCallback)

Support for web authentication (WebAuthn) journeys and trees.

First public release