Changelog

What changed, and when.

2026

October

161 updates

October 29

2026-10-29/c974ecb

Typing no longer jumps the page in Dia

In browsers that hide cookie notices on their own, such as Dia, sign-in and other pages no longer add empty space at the bottom or scroll to the field you're typing in.

2026-10-29/9da4319

The sign-in, create account and error pages now fit a laptop browser window without scrolling, so typing in a field no longer moves the page.

2026-10-29/2dd6dfb

What this production release includes

Production gets the site fixes, sign-in padlock and tenant sign-in improvements listed in the entries above, and invited Beyond the Login staff can now finish signing up with their beyondthelogin.com address.
Production still shows the 12 validated Identity Fundamentals lessons and their labs. The rewritten Foundations, Sign-in and federation and later lessons, their labs and the Challenges stay on the development site until each one is validated.

2026-10-29/2dd6dfb

Signing up with a beyondthelogin.com address now stops if the staff invitation is withdrawn or expires part way through, so it can never create an ordinary account there.

2026-10-29/42d0bea

Every lesson and lab rewritten in the guided format

Every lesson after Foundations now reads like Foundations: one scrolling page per lesson with a progress bar, terms explained before they are used, new or redrawn teaching figures in many lessons, and quizzes with new questions on the main ideas. This covers Sign-in and federation, Authorization and policy, Identity governance, Privileged access, Identity security, Troubleshooting and every Specialist topics series.
Every lab now follows the step-by-step lab guide: one task at a time, with the lab's people signing in from private windows. Many steps that described a label, refusal or result your lab tenant does not show were corrected.
The lessons now follow consistent people from lesson to lab, such as Ava at the photo service, the printer and the collage app in OAuth and OpenID Connect, so an example continues into its lab.
In the workload identity labs, Run and Renew now keep the client and registration you chose after Create or Refresh.
People invited as Beyond the Login staff can now finish signing up with their beyondthelogin.com address. Other beyondthelogin.com addresses still can't be used to sign up.
Rewritten lessons need Lesson Validation again before they reach production.

2026-10-29/ace04dc

The sign-in padlock stays up longer

Left alone on the sign-in page, the padlock now keeps wandering and acting out scenes for about three minutes before it dozes off, instead of nodding off after a few walks.

October 28

2026-10-28/1bf8fb5

Clearer pages across the site, and a playful sign-in padlock

Pages across the site were reviewed and tidied: clearer focus, loading and error states, plainer wording, steadier spacing and fewer labels above headings, in your account, the tenant portal, Learn, Docs, the Lab, Capture the Flag and error pages.
Left alone on the sign-in page, the padlock now wanders beside the sign-in window and acts out short identity scenes, such as spotting a phishing page or checking a token's signature. Any key, click or tap sends it home, and it stays put if you prefer reduced motion.
The landing page shows a current view of Capture the Flag, and on phones it shows the challenge to start with at a readable size.

2026-10-28/be13306

Foundations lessons and labs rewritten, with optional Challenges

Identity proofing, Technical foundations and Credentials and keys now read like Identity fundamentals: one scrolling page per lesson with new teaching figures, every term explained before it is used, and quizzes on the main ideas.
Every Foundations lab now follows the step-by-step lab guide. The Technical foundations labs teach bash scripting one skill at a time, from your first command to scripts with functions and safety settings, and the Credentials and keys labs build on those skills.
Several certificate, XML signature and JOSE lab steps were corrected so they match what the tools and your lab tenant actually do.
Optional Challenges now close three parts of Foundations: Working in a terminal, How the web works, and Credentials and keys. Each gives you a problem and your own data to solve it with no steps, hints you can reveal one at a time, and a server check of your answer. Challenges appear with the labs but never count toward lab totals.
The lab toolkit reference now shows which toolkit commands match the functions you write in Technical foundations.

October 27

2026-10-27/6414268

Four more validated Identity Foundations lessons for production

Production now also includes Keys, encryption, and signatures, Protecting credentials and messages, Giving another application limited access, and History of SSO, with their labs and challenges.

2026-10-27/f74a041

SAML metadata opens in your browser

Opening a tenant's SAML metadata in your browser now shows the XML in the tab instead of downloading a file, so lab steps that ask you to read it work as written. Applications that fetch the metadata still receive it as SAML metadata.
The History of SSO lab now asks you to compare Actor on the authorization and token audit rows, and explains why only the authorization row names who made the request.

2026-10-27/8467494

Password eye button fixes

Password fields in CTF challenges now have the same eye button as the rest of the site.
A password or client secret you showed is hidden again when its form is cleared, for example when you open Set password for the next person or after the HR simulator tests a connection.
Secret values in a lab's request console now use the same monospace text as the values beside them.

2026-10-27/dfcd885

An eye button for passwords, and a steadier Lab page

Password and client secret fields on this site, tenant pages and the lab tools now have an eye button inside the field that shows or hides what you typed. It replaces the Show passwords checkbox on the reset password page.
When a sign-in page fills in your remembered email address, an X inside the field now clears it and forgets the address. It replaces the Not you? link described in the previous update.
The Lab page no longer jumps while your lab progress loads. Within a browser tab it shows your progress straight away, and the first visit shows a placeholder the same size as the lab card.
Sending a request from a lab's request console before you start the lab now tells you to start the lab first.
Labs where a different person signs in from the same browser now tell you to clear the remembered email address with the X when the sign-in page shows someone else's address.
Identity Fundamentals labs end with a shorter clean-up step, and a few labs drop notes and checks that repeated earlier steps or raised points the lesson hadn't covered.
The site footer now shows the policies and Cookie settings as a Legal column in the site map instead of a separate row.
Learn progress marks now draw at one size on displays scaled to 125%, 150% or 175%.
In Lesson Validation, labs with changed steps show as not validated until they are checked again.

October 26

2026-10-26/c6b0cce

Sign-in remembers your email, and clearer lesson figures

Sign-in pages on this site and on tenant addresses now remember the last email address that signed in on your browser and fill it in for you. Choose Not you? to forget it.
Tenant administrators can turn this off on the Authentication page. It is on by default.
The Cookie Policy and Privacy Policy now describe the cookie that remembers your email address.
The figures in Identity Fundamentals and the History of SSO lesson now each show their section's point, such as side-by-side comparisons, what a check does and doesn't prove, and numbered steps, instead of a few boxes joined by arrows.
The Learn overview's Who this is for section now says the material aims to build your skills to an engineer's level and gets technical and hands-on. The separate work-in-progress note is gone.
The Use one sign-in in another application lab now explains why two accounts with the same email address from different providers stay separate.
A setup page with nothing left to ask for now lets you finish signing in, for example after an administrator relaxes the sign-in requirements.
This site's sign-in page no longer includes sign-in methods that are switched off.
Detail panels no longer leave gaps under short values when a value next to them wraps onto more lines.
The home page screenshots of a lesson, the tools and Capture the Flag are retaken in both themes.
In Lesson Validation, lessons with redrawn figures show as not validated until they are checked again.

2026-10-26/615a642

Clearer working rules for our AI assistants

Behind the scenes, the instructions our AI coding assistants follow are shorter and up to date. Nothing on the site changes.

2026-10-26/dc6d55e

The padlock's dizzy swirl follows your circling

Circle the padlock clockwise and the background swirls clockwise; circle it the other way and it swirls the other way.
The screenshots on the home page now show the new padlock logo.

October 25

2026-10-25/152e829

Every sign-in screen, on this site and on tenant sign-in pages, now asks for your email address once. Sign in, Email me a sign-in link and Email me a code are buttons on the same form.
Required setup after sign-in now shows only the steps you still need, one at a time. Optional sign-in methods are no longer offered during sign-in or registration. You can set them up from your Security page whenever you like.
The second step for people who hold roles now starts switched off, so making a method optional no longer forces anyone to set it up at sign-in. The Authentication page warns when a second-step setting will ask people to set one up at their next sign-in.
Sign-in, registration, password reset and consent screens no longer repeat themselves. After you ask for a reset email, the button changes to Resend email with a short countdown.
Giving another application limited access now takes one idea at a time: why an app shouldn't get your password, who takes part, consent, access tokens, scopes, refresh tokens and disconnecting. Its figure, glossary links and quiz questions follow the simpler flow, and the code exchange is left to the OAuth lessons.
Capture the Flag now lives only in the Lab. Its old Learn address takes you to the Lab's Capture the Flag page.
In Lesson Validation, a check counts only while the lesson or lab it covered is unchanged. If the page is edited afterwards, it shows as not validated, with a note naming what changed, until it is checked again. Checks made before this change did not record which version was checked, so every lesson and lab needs checking again, and the page says so beside each one.
Five labs now match the simpler sign-in screens and the new second-step setting.

2026-10-25/47d65c6

A simpler Learn overview, and progress grouped like Learn

The Learn overview has a new introduction and a Who this is for section that explains who Beyond the Login is for and what it focuses on. It no longer describes each section one by one, and its closing link now takes you straight to the first lesson, What is Identity?
Start here and Training paths have been removed. Their addresses, and the Start here buttons on the home page, now open the Learn overview.
The Learning tab on your profile now groups your lessons by section and group, in the same order as the Learn menu, with your progress and next lesson for each section.

October 24

2026-10-24/9dac01e

Four more validated Identity Foundations lessons for production

Production now also includes Clients, servers and addresses, How applications communicate, Staying signed in, and Trust across systems, with their labs and challenges.

2026-10-24/b1be0a7

Lab Quizzes and today's fixes reach the site

A check in the site's build stopped the previous update (Lab Quizzes and the fixes listed with it) from being published. That check now passes, so those changes are live.

2026-10-24/5daee52

Practice what you've learned with Lab Quizzes

The Lab has a new Quizzes page. Choose which lessons to practise (the ones you've completed, all of them, or any sections and single lessons), then answer questions one at a time. Each question links back to its lesson, and each round shows how many you got right this time and across all your rounds.
Quizzes draw on more than 1,500 new questions covering every lesson, in six kinds: multiple choice, select every answer, true or false, put in order, match, and type the answer. You can limit a round to multiple choice.
When you're signed in, your all-time quiz totals are kept with your account. Your answers stay in your browser. The Privacy and Cookie policies describe both.
Five lesson passages are now more precise, including what a reused refresh token usually means, when a Lax cookie is sent during front-channel logout, and which characters must be encoded in a query value.
Trust across systems has clearer federation paragraphs, and its lab explains where the standalone sign-in page takes you.
The Staying signed in lab no longer asks you to wait out a five-minute idle timeout.
Capture the Flag now has its own group in the Lab, after Specialist topics instead of inside it, with its own progress.
A wrong password on a tenant's sign-in page is now answered in place, without reloading the page.
Starting a lab asks before replacing your lab tenant only when the lab set up there is unfinished. Labs that use both lab tenants show each tenant's sign-in on its own row.
The Token Decoder shows each token's encoded value above the header and payload it decodes to, and lists its checks as rows with a clear result for each.

2026-10-24/789e18a

Clients, servers and addresses shows how to find a registrable domain

Clients, servers and addresses now works through two full addresses to show the host, the public suffix and the registrable domain, and explains where the list of public suffixes comes from.
The paragraph on subdomain takeovers moves out of this early lesson, and Staying signed in now describes the same cookie risk in plain terms: a forgotten name that now serves someone else's pages.
The Clients, servers and addresses lab notes that percent-encoding is more commonly called URL encoding.

2026-10-24/66c993f

Capture the Flag challenges open where you're working

On the Lab page, a Capture the Flag challenge you're working on now opens its Specialist topics section and stage, as a lab in progress does.
Screen readers now hear whether a Lab sidebar group counts labs, challenges or both.

2026-10-24/c6c2083

Capture the Flag joins Specialist topics in the Lab

Capture the Flag is now a set of labs in Specialist topics instead of a separate section. In the Lab sidebar and on the Lab page it comes after the other Specialist topics, with its challenges grouped by stage. All challenges still opens the Capture the Flag page.
Each challenge shows your progress beside the labs, and the sidebar updates as you work through a challenge. If your challenge progress can't be loaded, challenges show as unknown, not unfinished.

2026-10-24/9cb0e21

Identity fundamentals explain every idea before using it

Every Identity fundamentals lesson now explains its terms before it relies on them, from tenants, credentials and passkeys to ports, percent-encoding, bearer tokens, cookies and cross-site attacks, issuers, audiences and the JWT format. The lessons no longer point ahead to later lessons.
New diagrams show how a sign-in link's return address is checked, how messages travel through the browser or directly between services, and which requests can use a session cookie.
The Identity fundamentals labs explain the product terms they use and stay within the series. The How applications communicate lab now gives the right reason for a refused album request.
Five new quiz questions cover phishing-resistant sign-in, return destinations, API challenges, cookies that scripts can't read, and breached passwords.
HTTPS and certificates in practice explains certificate names more clearly.
Lab pages lose their separate toolbar row: the task list, the One task or All tasks switch and Lab options now sit beside each task's place line, and Ava's sign-in details appear once, in Before you begin.
The request console shows a more compact response, and its values card fits a full issuer address on one line.
The hover ripple fades out smoothly after a short hover, and the single-page app Capture the Flag challenge now publishes its server details at the address a client expects.
Reviews of lesson and lab changes now check that readers have enough guidance for the point they've reached.

2026-10-24/41a0203

The padlock talks, gives hints and dreams

Lab pages now have the padlock too, beside their checks. It cheers when a check passes, unlocks when you finish the lab, and looks puzzled when Check progress finds nothing new.
On lessons and labs, press the padlock for a hint: the quiz's own hint for the question you're looking at, or the lab's next step. It also says a few words in a small pixel speech bubble when you finish a quiz or get an answer wrong.
Leave it alone for a while and it thinks out loud in a thought cloud. On the home page, sign-in and error pages it then falls asleep and dreams: counting sheep, floating Zzz or a cookie, and on an error page it thinks things over. Bubbles and dreams stay still if you've paused motion or asked your device for less of it.
On the sign-in page, the padlock now and then swings round a gymnast's high bar while you wait. Its pointer games are steadier too: circle it to make it dizzy, or shake the pointer beside it to make it sneeze.
Pressing the padlock or the ASCII art no longer selects text on the page.
A check that keeps the logo crisp.

2026-10-24/4c7ef33

Request consoles inside each lab task, and steadier lesson pages

In the Identity Fundamentals labs, each task that sends requests now ends with its own request console, right below its instructions, so you no longer scroll to the top of the page to send a request and back down to read the result. Across labs and Docs, long request and response bodies now scroll inside their own box instead of stretching the page.
When you read every task at once, the guide rail now marks the last few tasks, such as Cleanup and Debrief, as you reach the bottom of the page.
Moving between lessons while signed in now keeps your account menu and Learn progress on screen instead of flashing placeholders. The browser tab keeps a copy of your name and which lessons you've started, never your email or answers, and clears it when you sign out or close the tab. The Privacy and Cookie policies describe it.
Several Capture the Flag challenges now point you to the routes worth investigating. In The Secret SPA, the photo app names its OAuth settings and publishes its sign-in metadata, with clearer hints. The Wrong Audience, Redirect Me, A Sign-in from Another Session and A Message Runs as the Reviewer now name the paths that matter in each attempt.

2026-10-24/e92055a

The Cookie Policy now lists every place that remembers whether you paused moving parts of the site: the home page, the background behind sign-in and error pages, the padlock on lesson pages and the design system reference page. Nothing new is stored, and the choice still never leaves your browser.

October 23

2026-10-23/f3048bc

Training paths, one path at a time

Training paths now lists every path in the sidebar, grouped into places to start, paths for your role and deeper topics. Choose one to see just that path, and use All lessons at the top of the list to get back to every lesson. On a phone, pick the path from the list at the top of the page.
Each path's lessons are now grouped by topic, such as OAuth 2.0 or SAML, with smaller topics inside, so a long path no longer reads as one long list. Lessons keep their numbers in the path's order.
When you're signed in, each topic shows how many of its lessons you've finished, and the topic with your next lesson opens for you.

2026-10-23/82f74a2

Capture the Flag, rebuilt on the Lab design

The Capture the Flag catalogue now works like the Lab catalogue: it opens with your current challenge and its phases, shows how many challenges you've completed and what's next, and lists every stage with your progress.
Each challenge page is now a workspace: the five phases across the top, only the controls for the phase you're in, and the flag, explanation and the target's request log beside them.
The skills list in Prepare now shows one row per skill, whether you practice on your own, in a tenant or at BTL.

2026-10-23/fee3729

A calmer Lab toolkit page

The Lab toolkit page now opens with the download, three short update steps and a plain summary of what the toolkit will and will not do, instead of the full command reference.
Commands are grouped by what you're doing, and each one starts with a sentence on what it's for and an example, with its options one click away.
Long values such as checksums now wrap on narrow screens instead of running off the side.

2026-10-23/5b82547

Lab 5, "Check Ava's sign-in address before she signs in", now has you read the sign-in page's address and inspect its certificate before you type Ava's password, as the lesson advises. Signing in and editing the return address come afterward.
Each step now connects to the lesson: which program is the client and which is the server, why the address shows no port, how your lab tenant's name sits under a shared zone like the lesson's hosted-site example, and what percent-encoding in an address means. The certificate steps and the end-of-lab self-check are shorter.
If you were partway through Lab 5, your progress carries over; only the order of the steps changed.

2026-10-23/71562a2

The padlock now stands on your tenants' sign-in pages too, including the second sign-in step, the email link page and the sign-in step of an app's request, just as it does on the site's sign-in. It thinks while a sign-in is sent and looks sad when an attempt fails.
The lab task list no longer prints status lines such as "Found" under its tasks, since the ticks and badge already show them. Screen readers still announce them.
In All tasks view, the task list now moves to the next task once that task leads the view, instead of waiting until its top reaches the toolbar.
Behind the scenes, every update now redeploys all of the site's services together, so pages served by different parts of the site stay in step.
If your lab progress can't be checked, the lab's task list now says so on screen, not only to screen readers, until the next check works.

2026-10-23/19da16e

A new logo, and a padlock that learns with you

Beyond the Login has a new logo: the padlock itself, drawn in pixels with a lime shackle and two eyes. You'll see it in the site header, on the sign-in page and in your browser tab, which now has a sharp small icon too.
Each lesson now has the padlock beside it. On wide screens it stands at the bottom of the side column and grows to fill the space. On smaller screens it waits at the end of the quiz. It hops when you get a question right, looks puzzled when an answer isn't right, and unlocks when you finish the quiz.
A pause button at the padlock's feet stops it. Your choice carries over to the home page and the sign-in background.
The sign-in and error page backgrounds now use the home page's soft dots and rings, and they react to the padlock: sparkles when it unlocks, a droop when it's sad, ripples when it lands.
On the home page, closing a window now dissolves it into dots that come back a moment later, and minimising drains it into its title bar.
The home page padlock is easier to make sneeze.

2026-10-23/19ce89d

A friendlier front page, and a padlock on every error

The home page's ASCII art is now drawn in soft dots and rings, and it ripples, sparkles and jumps whenever the padlock lands, stomps or sneezes, on any screen size.
The padlock now shows how each part of learning works: inspecting with a magnifier, following a diagram, and mixing a flask. Another one peeks over the lesson window in the library section.
Every error page now has the padlock, and its mood matches what happened. It gets dizzy when a page isn't found, sleepy when a service is down, and cross when too many requests arrive.
If you open a page and something fails, you now get a proper page that explains it, instead of raw technical text.

2026-10-23/84cc3ae

In Identity Foundations labs, the Start card now always shows the lab person's username. Once you start the lab, their password appears beside it with a copy button. Reset password gives them a new password in one click without resetting your lab, and Reset lab sits right beside it. The same details open from the toolbar on every task.
The Lab catalogue now opens with the lab you started most recently, your overall progress and the next labs to try. Each series is listed as a numbered index.
In All tasks view, a rule and a line such as "Walkthrough · Task 4 of 10" now separate each task, and task headings carry the same number as the task list. Switching views keeps you on the task you were on, and Back and Forward keep the right task highlighted.
The lab task list is simpler. It has no counts, times or status words, and no Check now button, because progress checks on its own and again when you return to the page. A finished lab now says Completed.
Lab pages no longer end with a box repeating the lab they build on. The link at the top already names it.
The lesson pager's Previous link now ripples from right to left, the direction it leads.
Behind the scenes, our automated checks run faster.

October 22

2026-10-22/3145e17

BTL Admin's Users list and account details now show when each person last signed in on the site. Accounts show "Not recorded" until their next sign-in.

2026-10-22/2fd8d42

A steadier lab task list

In All tasks view, choosing a task in the lab's task list now highlights that task and scrolls it to just below the toolbar. Before, it could highlight the task above it instead.
In One task view, choosing a task after scrolling down now shows its heading just below the toolbar instead of hidden under it.
Tasks keep their number once their checks are found. Ticks now mark only the checks, the steps the lab confirms for you.
Checks are indented under their task, so they stand apart from the tasks themselves.
A check you met in an earlier attempt shows its tick without an extra earlier label.

2026-10-22/86f047c

Meet the padlock

A small dithered padlock now lives on the home page, the sign-in pages and the page you see when a link is broken. Poke it, circle your pointer around it, or shake your pointer quickly to see how it reacts.
When you sign in, it thinks while your details are checked, unlocks when you're in, and looks sad if sign-in fails. It looks the same for every kind of failure, so it never gives away what went wrong.
The ASCII art on the home page reacts to the padlock, and the minimise and close buttons on the home page's windows now do something playful.
On phones, the home page's course outline now fits the screen, and there is less empty space under the diagrams.

2026-10-22/b0623ff

Clearer Identity Foundations labs and four new CTF challenges

Identity Foundations labs list their tasks in one panel on the left. Each check sits under the task it belongs to and shows when it was found, with Check now at the bottom.
Start lab in Before you begin is the only button that sets up a lab. Next now only moves between tasks.
Your lab's sign-in details stay one click away in the toolbar on every task.
Lost a lab password? New password gives that person a fresh one without resetting your lab or your progress.
Reset lab now lives in the lab's options menu, appears only after you start a lab, and asks before it rebuilds anything.
A switch beside the task list shows one task or all tasks, and the lab content now uses the full width of the page.
On phones, a task button opens the task list and its checks.
The Clients, servers and addresses lab now checks two more steps: following a return address on your own tenant, and seeing an outside one refused.
That lab's tables show your lab tenant's real hostname, and new figures show where to find a site's certificate details in your browser.
Capture the Flag adds four challenges: Same Email, Different Identity; Two Issuers, One Callback; One Proof, Two Requests; and Deactivated, Still Signed In.

2026-10-22/d2a0087

Rippling workspace cards

The section cards on your tenant's Overview and on BTL Admin's Overview now ripple in ASCII when you hover over or focus them, like the site's other links that move you forward.

2026-10-22/99a4c42

Smoother motion and a cleaner layout

Links that move you forward, like the landing page buttons and the next and previous lesson links, now ripple in ASCII when you hover over or focus them, matching the site's artwork. Their arrows nudge toward where they lead.
Menus, dialogs and pop-up panels now fade or slide in and out instead of appearing abruptly. Switching theme crossfades the page, and a wrong quiz answer gives a small shake. Everything stays still when reduced motion is on.
Text sizes now follow each element's role, so headings, body text and labels stay consistent from page to page.
Cards and panels have a single frame, with no boxes inside boxes, and even spacing on every side.

2026-10-22/20a429d

Tidier lesson section list and a lighter sign-in background

The Sections list in Identity Foundations lessons opens as a compact grid that slides down over the page, so it takes far less room and no longer pushes the lesson down. It opens instantly when reduced motion is on.
The moving background behind the sign-in, registration and error pages now uses about half the processing time, so it runs more smoothly on slower devices and in browsers with extensions, while looking the same.

October 21

2026-10-21/cf6cb52

Clearer lab controls and browser guidance

Guided labs place Force Refresh at the top right of each Your progress card.
Identity Foundations labs make it clearer which browser window and account to use for each step.
Lab Inbox message subjects look clickable.
The cookie notice keeps footer controls and keyboard focus clear without adding empty space below the page.

2026-10-21/165acd1

Find your current lab

The Lab page links to your most recently started lab above the full list, making it easier to pick up where you left off.

2026-10-21/77adbf0

Existing tenant sign-in pages keep their layout while the site assets and tenant services update.

2026-10-21/e3ba15d

Four validated Identity Foundations lessons for production

Production includes What is identity, Establishing an identity, Proving control of an account, and Deciding what someone can do, with their labs and challenges.

2026-10-21/c4061a9

Clearer session settings and more reliable lab progress

Guided lab progress sits in a matching card beside the task instructions.
Lab 4 uses a user the helper is allowed to lock, checks that roles were actually removed, and recognizes the helper's later access refusal across tenant operations.
Flow policy explains total session limits and inactivity separately, makes BTL administrator limits clear, and updates the lab instructions to match.
Repeated builds keep BTL account scripts separate from tenant sign-in scripts.

2026-10-21/2893d6c

Scrolling Identity Foundations lessons and clearer figures

All 12 Identity Foundations lessons now read as one scrolling page. A progress bar under the header shows which section you are in and how far through the lesson you are. It also opens a list of the sections, the quiz and the lab.
The hand-drawn panels in those lessons are now proper diagrams that show how the parts relate, such as who sends what to whom, or what changes from step to step.
The OAuth lessons have redrawn diagrams for endpoints, the authorization code flow, its possible outcomes and choosing a flow. The History of SSO lesson has a new timeline, and two troubleshooting guides return to step-by-step sequences.
Diagrams too wide for the screen now shrink to fit and open full screen with a tap, instead of scrolling sideways.
Links to a section land just below the progress bar, and links to optional detail open it. Printing still includes every optional detail.

2026-10-21/7e96406

Lab reset, clearer progress and steadier reading

Lab Setup can reset the current lab and regenerate its sign-in credentials, with confirmation before replacing work. Recorded completions stay saved.
Lab 3 now requires a successful authenticator-app sign-in. Its browser setup and cleanup instructions are clearer.
Guided labs have a Force Refresh button for progress and remember whether you show all tasks or one task at a time in this browser.
Lessons and labs keep short steps and navigation steadier while allowing longer content to scroll normally.
Documentation focuses on using the product and configuring tenants, with internal architecture material removed from the public docs.
The moving background follows the pointer more closely, and clicking empty space on sign-in pages no longer selects text.

2026-10-21/c2e741c

Labs no longer show a freshly started lab as completed. Setup shows Replaced as soon as Check progress finds another lab replaced its environment, and lab sign-in details name the lab tenant they belong to.
The lab request console clears an earlier response when a new request is sent or refused, and Lab Inbox shows how long each message is kept.
Tenant Overview explains when your roles do not include it, and says plainly when an account has no access to a tenant. The Lock confirmation promises an unlock only when your roles allow one.
Keyboard focus stays in place after signing a browser out, after changing group members, OAuth keys and managers, after a proofing review and after actions on the tenant Security page. Sign-in method buttons say which method they change.
Signing in again returns you to the page you were on. An application's sign-in page keeps your email after a wrong password, and finishing required sign-in setup returns you to the application.
The sign-in page explains when a password change in another browser signed you out, and email verification no longer says a link was opened in another browser when it was not.
Identity proofing shows where your application stands after a reload, a deleted tenant's address shows a page with a way back, and session times show seconds. Refreshing an old Security page no longer disconnects an application you approved again.
History, directory role errors, the authorization request builder, the discovery checker and the certificate tool give clearer, current results.

October 20

2026-10-20/009eef3

Fuller Identity Foundations lessons and simpler lab setup

All 12 Identity Foundations lessons have fuller explanations, diagrams and numbered topic sections, with optional detail beside the relevant topic.
Labs use simpler task navigation and update progress automatically, with checks beside the work.
Next prepares the lab when needed. Setup no longer shows status badges or a separate Start button, and confirmation appears only when continuing would replace another lab's work.
Generated sign-in details stay available between tasks, with copy controls and a collapsible panel. Recorded completions remain intact when switching labs.

2026-10-20/9a8ff1f

Story-led Identity Foundations lessons

All 12 Identity Foundations lessons now use visible numbered scene buttons, framed scenes, concrete stories and diagrams to make each step easier to follow.
Optional detail stays beside its scene. HTTP request and response examples are part of the main explanation, and quizzes remain focused on that explanation.
Scene navigation works across screen sizes and with a keyboard, while read-all, printing and direct links remain available.

2026-10-20/9c409e6

Identity Foundations lessons now use short guided scenes, with optional detail beside the relevant explanation and quizzes focused on the main content. Readers can also show the whole lesson or print it.
Foundation labs now guide one task at a time, keep observations and server-checked progress beside the work, and preserve the existing lab controls.
Lessons have clearer HTTP examples and fewer vague next-lesson lead-ins.
Site and tenant sign-in pages share consistent branding and footer styling, with simpler login window titles.
Production lesson eligibility now requires the owner's lesson and lab reviews; the second review remains advisory. Deployment guidance and checks now cover the complete site and its supporting services.

2026-10-20/3348235

Sign-in, registration and error pages fit a laptop window, and typing no longer scrolls the page while the cookie notice is open.
Lab activity now leads with each task's plain name, and a labelled Check progress button sits in the activity window and at the end of each lab.
A wrong current password on Security now says so under the field instead of signing you out. A browser signed out by a password change or reset now says why.
Signed-out visitors no longer briefly see account pages or a Sign out button.
Logs on your account history and on tenant Logs pages load again.
The JWT decoder reports a text `exp` only as a type problem, and the request builder flags scope characters OAuth does not allow.
User directory errors describe the user edit, not OAuth settings, and a refused Lab Inbox says you can't open it instead of telling you to restart the lab.
Choosing a cookie option returns keyboard focus to where you were and reads out your choice.
The home page has a new Hands-on labs section showing a real lab and its activity window as you work.
The moving backgrounds on sign-in, error pages and the end of the home page now respond to you: they swell where your pointer is and ripple where you click.
BTL Admin's Capture the Flag, Authorization, Governance and Alerts pages now need their own permission. Staff with only that permission can open them, and Users access alone no longer opens them.

2026-10-20/7c26d89

Cleaner lab setup and simpler administration

Lab Setup now keeps requirements, tenant links and Start together, while retaining What Start sets up. Sign-in details explain their purpose and give the username and password separate copy buttons, with a reminder to keep them stored until the lab is finished.
Lab prerequisites now show the previous lab and where to pick up unfinished work. Activity checks identify unnumbered sections by name.
Tenant and BTL organization overviews put workspace links first and group usage limits into collapsible sections.
BTL Admin brings staff profiles into Users and gives invitations their own Invites page, with controls shown according to the administrator's permissions.
Local build checks exclude a saved rollout copy of the project.

2026-10-20/1b59036

Sign-in, registration and error pages now sit in one centred window over a slowly moving ASCII landscape. Its pause button remembers your choice.
Error pages raise the status code out of the background and show the response your browser received.
The home page ends with a lime and teal ASCII mosaic. The site footer now lists the main parts of the site.
Signing in from a signed-out account page, or after an expired login, returns you to the same page and tenant. Creating an account from a sign-in link does too.
Lab and tenant pages you can't open, and page loads that hit a rate limit, now show a titled page that says what happened and how long to wait.
User directory saves name the person and the action. Its search and Action filter cover every action it records.
OAuth client IDs stay whole on phones and have a copy button.
Cookie settings shows the choice you already saved, and focused controls stay clear of the cookie notice.
Tenant-hosted pages have Skip to content, and refreshing lab activity always responds. Verifying an email code during a status check no longer asks you to retry.

October 19

2026-10-19/97858d7

Reliable progress and smoother page interactions

Completed lesson quizzes and previously correct answers now survive question changes. Practice again clears your answers while keeping your completion and its original date.
Learn and Lab navigation reserve space for progress before it loads, and show an unknown count when progress cannot be read.
Switching browser tabs preserves open dialogs, form edits, history filters and other page interactions while session checks continue.
Tenant and BTL organization password settings now default to eight characters. Saved settings still apply, and administrators can choose stricter requirements.
Lab email stays inside the private Lab Inbox, with stronger checks on outgoing messages.
Site signup now rejects addresses on the reserved Beyond the Login domain, including unfinished signups.
The identity lab now asks a clearer reflection question about the example table.

2026-10-19/7e25d1a

Clearer tenant workspaces and Discord community updates

Lab Inbox now lives in your lab tenant's portal. Choose the lab tenant from your account menu, then open Lab Inbox to read verification, sign-in and recovery messages. Lab instructions link to the matching inbox.
Tenant management and BTL Admin now group navigation into People, Sign-in, Access, Labs and Activity. Lab navigation also marks each completed lab.
The authorization introduction now explains API requests and responses before the quiz. The next lesson clarifies client and server roles, makes the URL table easier to read and asks a clearer question about hosted sign-in pages.
Discord now celebrates earned lab ranks and badges in role-updates, and /help and /commands list the bot's commands. Connection guidance and the privacy page explain achievement announcements.
Discord join announcements move to introductions, lab channels require a linked account, and the retired Discord changelog channel is removed. BTL Admin shows the results of these server updates.
Local build checks now exclude the nested working copy, use the current lesson catalogue and check dialog dismissal without missing an early close event.

2026-10-19/a892056

Lab messages now arrive in a private Lab Inbox on the lab page, so verification, sign-in and recovery exercises no longer need personal email accounts. You can filter messages and copy their codes or links.
Lab accounts now use addresses ending in @lab.beyondthelogin.com. Starting a lab prepares its accounts and a fresh inbox, and the instructions explain where to find messages.
Lab navigation now shows completion counts and status icons, with improved sidebar alignment.
Lesson diagram summaries now describe what each diagram shows, and the authorization introduction avoids repeated explanations.

2026-10-19/2df40a6

A reviewed and rebuilt curriculum

Every lesson, lab, Capture the Flag challenge and troubleshooting kit was checked against the standards it teaches. Where a lesson and its lab disagreed, both now say the same thing and match the specifications.
Sign-in now follows current password guidance: new passwords need at least 15 characters, with no rules about which kinds of character to use. An emailed code or link no longer counts as a second factor, and sign-in records use only standard method names.
Applications that sign in with a signed client assertion must now name the sign-in service itself as its audience, and the sample photo API answers "not found" for albums you cannot see, as the lessons recommend.
Foundations now teaches what the later lessons rely on: JSON Web Tokens taken apart byte by byte, signing algorithms, certificates, XML signatures, time and timestamps, cross-site scripting and how browsers treat third-party cookies.
The passkey, SAML, Access in context and Troubleshooting lessons were rewritten with real messages and examples, and new lessons cover assurance levels, SAML bindings and signature wrapping, Kerberos delegation, client ID metadata documents, single-page and native apps, detection queries, session and token lifetimes, account recovery, privileged access and secrets, multi-tenant sign-in, migrating an identity provider, browser privacy changes and policy as code.
Lessons that taught the same thing twice were merged, so each idea has one home. Old addresses take you to the right section, and progress you earned on a merged lesson or lab still counts.
Labs are more hands-on: four troubleshooting kits now start from a teammate's hidden change, credential and directory labs verify real artifacts, and labs that teach expiry wait seconds instead of minutes.
Training paths are now focused role tracks, with optional lessons marked, and Troubleshooting follows the core lessons.
Quizzes can hold up to four questions, many dense lessons gained new ones, and answers no longer follow a predictable pattern.
Capture the Flag challenges have more realistic answer choices, hints that guide without giving the answer away, fuller explanations, and two overlapping challenges were combined with their closest match, keeping any credit already earned.
Tenant sign-in now follows the OAuth and OpenID Connect rules more closely: new tenants refuse loopback redirect addresses for web applications, newly registered applications must ask before receiving offline access, claims requested outside the granted scopes need consent, access tokens can no longer be used as sign-in assertions, error responses use the standard codes, and protocol Audit can be filtered by action, date and request ID. Existing applications keep working as before.
Tenants whose two-factor requirement could only be met with an emailed code now offer an authenticator app instead, or keep reporting on the requirement until one is set up, so no one is locked out. Every change is recorded in Audit.

2026-10-19/a8087e3

Inviting staff to Beyond the Login

BTL administrators can now invite someone by email from the Users page and choose the roles they start with. When the invited person signs up, they verify their address, choose their own password and join with those roles.
Invitations last 14 days and can be resent or withdrawn. Every invitation, resend and withdrawal is recorded, and only administrators who can grant the chosen roles can send them.

2026-10-19/525dc0b

Fixes from testing the site the way visitors use it

If you open a tenant management or BTL Admin page while signed out, you now go to sign in and come straight back to that page.
Saving your name in one tab no longer silently undoes a newer change made in another tab. You are asked to reload instead.
Signing in or registering right as the page loads no longer empties the form.
After "Your login has expired", logging back in returns you to the lab or admin page you were on.
Opening an email verification link in a tab that is already on the verify page now works.
A completed lab stays marked Completed after you start the next lab.
Audit now names the roles, clients and scopes involved, says which name fields changed, and shows people's names beside their IDs when you can already see your users.
Audit search finds the words shown in each record, and its filters only offer what the chosen source records.
Keyboard and screen reader users keep their place: dialogs open with focus in view, focus returns to the right control after saving or switching tabs, and changing Audit's source is announced.
When you cannot manage a tenant, pages say so plainly instead of asking you to sign in, and Guided Services no longer loads forever.
Your Profile only offers changing your email address when that option is turned on.
A long name no longer pushes the sidebar over tool buttons.
Quizzes no longer tell screen readers to enable JavaScript when it is already working.
After you delete your account, the page no longer asks you to log back in, and the Activity page no longer shows staff controls before checking your access.
If part of a page fails to download, the page says so and Refresh loads it again. The Clients page's Docs link now opens the client guide.

2026-10-19/e127121

Lab progress checks without limits getting in the way

Lab progress checks now have far more room, so the lab-activity window and its refresh button never run into a limit while you work, even when a whole class shares one network.

2026-10-19/c695257

A lab page that follows your work

Each lab with automatic checks now opens with What you will prove: the checks the lab looks for, each linked to the stage of the lab that meets it.
Setup and your lab environment are one place now: Start sits at the top of Setup.
In those labs, a lab-activity window beside the steps updates on its own as you work, so there is no Check my progress button to press. Its small refresh button checks straight away and shows a tick or a cross for the latest check.
The lesson box shows just the lesson link.
Every lab is now split into named stages, each check sits beside the stage that meets it, and a short debrief at the end replaces the note that used to follow every step.

2026-10-19/c2eb5a6

Lesson text now uses the full width of the reading column, the same width as the Lab card, figures and quiz below it.
In the Learn menu, Identity proofing now sits directly under Foundations instead of inside its own Identity and trust heading.
The account menu entry for your own history is now called Audit and Logs and has its own icon.
Two new Discord roles. BTL Graduate is earned by finishing every section badge and every core Capture the Flag challenge. BTL Guest goes to server members who have not connected a BTL account, and connecting replaces it with BTL Learner. Your profile and the /rank command show your progress toward Graduate.
The main site can now publish only lessons that have finished review, with their labs and challenges, while the dev site keeps every lesson. Progress, badges and Discord ranks on the main site count only the lessons it shows.

October 18

2026-10-18/149c5fa

Faster pages, and fixes from testing the whole journey

Pages load much faster on slow connections. Each page now fetches its scripts as a few files at once, and the tenant and staff tools load only on their own pages.
Saving your name on Your Profile works again.
Profile, Security and Activity take you straight to sign in when you aren't signed in, instead of saying your session expired.
The SAML decoder now says when pasted XML isn't a SAML message.
After too many attempts, the message now says how long to wait before trying again.
Curriculum pages that shared the title "Foundations" now have their own titles, so browser tabs and search results are easier to tell apart.
Detail windows for OAuth clients, ID token managers, roles and rules now open at the top.
Long ticket subjects in Support now wrap instead of pushing the status off screen.
On phones, an error in a form window now scrolls into view, and saving your profile on a tenant's account page shows the result right away.
Start here has a button to the first lesson right under its introduction.
We tested the whole journey, from the landing page to the first lab, with simulated visitors, and added checks so these problems can't come back.

2026-10-18/e8f4bb7

Diagrams that fit what they show

Thirteen lesson diagrams now use the type that matches what they teach: comparisons sit side by side, checks and procedures are flow charts, and events over time are timelines with one lane per system. The last six diagrams that were still images now share the same figure style.

2026-10-18/eb00cc4

Lessons end with their lab and quiz

Lessons no longer close by sending you to the next lesson. Each lesson now finishes with its own material, followed by its Lab card and quiz, and the Next link after the quiz takes you on when you are ready.

October 17

2026-10-17/0c861df

One dialog for user details, and labs without status labels

In User Management, viewing and editing a user now happen in one dialog. Choose View/edit details on a user's row to read their details, then Edit details to change them in place. Administrators who cannot edit that user still see View details. Lab steps use the new names.
Labs no longer carry ready, partly ready or planned labels. Every lab has a walkthrough, a check of your work and cleanup, and any lab with checks records your progress. Completions you already earned still count.
In Audit and Logs, an event's details now show the actor and subject without repeating their type, since the actor type and subject type are listed beside them.
The Try it in the Lab card at the end of a lesson now has a clear Open the lab button.

2026-10-17/3a5eacd

Lab pages keep your environment and progress beside the steps

On wide screens, each lab page now shows its steps on the left and a lab panel on the right with the lesson, your lab environment and your progress. The panel stays in view as you scroll, so Start and Check my progress are always within reach. On smaller screens the same panel sits under the lab's title.
Your lab environment now lists your lab tenants by name, and each name opens that tenant in the tenant portal. Start stays the main button until your environment is ready. After that, Start again is a plainer button, because it rebuilds your tenant and discards your changes.
The lesson panel names the lesson sections the lab practises, with a link to each. What Start sets up and what each check looks for in Audit are now short lists you can open when you need them.

2026-10-17/1b2ad81

Guided labs reworked after a full curriculum review

Every guided lab was reviewed against its lesson and the labs around it, and all 332 labs were updated, most of them rewritten. Each lab now practises its own lesson, steps name the page, filter and button to use, and nothing a check depends on is hidden in a hint.
Labs checked through a lab case now read like every other lab. The case panel, the tenant portal, Audit and Logs use plain names instead of internal terms, a short "How this lab is checked" note explains the case once, and a new Docs page covers case labs in more detail. Guided services receipts show a Receipt ID you can copy.
Checks now prove the step they describe, so unrelated activity in your lab tenant no longer completes them, and exercises that repeated an earlier lab now practise something new. The decision models in 16 labs offer believable wrong answers instead of obvious ones, so answering them needs the lesson.
The lab toolkit adds commands for token exchange, backchannel sign-in requests, metadata checks and a callback listener that keeps running, and it now refuses a token without a key ID when its key set holds more than one signing key. Download version 1.11.0 again to use them. The terminal environment check now also covers dig and nc.
Tenants can require requested authentication levels for authorization requests, and can map a scope to a different downstream scope during token exchange; mappings cannot add sign-in or offline access scopes. Audit now shows the response mode of an authorization response, the claim sources in a UserInfo response, and the token identifiers linked by a user token exchange.
Audit now records refused UserInfo tokens, reused or expired reset and unlock links, and sign-ins refused by a sign-in limit, so these refusals are visible to tenant administrators. Each Audit record now shows its reason code beside the plain-language reason, tenant Logs show why an OAuth configuration change was refused, and when User Management or the role editor refuses a change, the form stays open and explains why instead of clearing the page.
Management pages still clear what they list when you switch to another tab, but a form you had open now reopens with what you typed when you come back to it signed in as the same person, so you can follow a lab in one tab and the portal in another. Passwords, secrets and one-time values are never kept.
Two troubleshooting labs now begin a real incident in your lab tenant. Audit shows that change as Lab case automation, so you investigate a change you did not make yourself.
Several training paths now include the lessons their labs rely on, and the Token Decoder can open with the scopes a lab asks for.
Seventeen short lessons on customers and partners, privacy, enterprise directories, verifiable credentials and social sign-in were rewritten with worked examples and quizzes, lesson examples now use the same scope names as the labs, and the agent and workload lessons now explain what to do when a reply is lost.

2026-10-17/ce39476

Easier-to-read lessons

Lesson text is a little larger and sits in a narrower column, so each line is easier to follow.
On screens without the side outline, an On this page list now opens from the top of every lesson.
Previous and next links show the lesson title with an arrow, and exercise answers span the full card.
On phones, diagrams stay full size and scroll sideways instead of shrinking, and Open full screen shows the whole drawing.
Series pages show each lesson's description before its reading time, and the footer lines up with the page.

October 16

2026-10-16/5926106

Shorter lab Setup steps

The rest of the labs' Setup steps no longer repeat what Your lab environment says about Start and the portal links, so each one begins with what that lab sets up for you.
Two behind-the-scenes records about lab environments now use the same log format as the rest of the service, which makes problems with them easier to spot and diagnose.

2026-10-16/88d72f3

A guide to your Lab and Personal Tenants

A new Docs page, Your Lab Tenant and Personal Tenant, explains the tenants every account has, what Start does to your Lab Tenant and which tenant opens by default. Your profile links to it.
Lab pages are simpler: Your lab environment no longer lists issuer addresses. Start fills them into a lab's Setup steps and request console, and a lab that needs one in its instructions points to the Hostname in Tenant details. Many Setup steps also no longer repeat what the panel says about Start and the portal links.
Opening the site in two tabs at once, or right after signing up, no longer starts setting up your first lab twice or counts it as two lab environment builds.
The copy buttons in Tenant details wait until the tenant ID and hostname have loaded, and stay off when a value is not available.

2026-10-16/ecfd875

A stricter check on the analytics script policy

The check on the site's security policy now covers every allowed script source, so a broader rule that could let automatic analytics run without your choice fails it.

2026-10-16/c240781

Analytics stays behind your privacy choice

Added a check that the site's security policy only allows our consent-based analytics loader, and documented how to fix the browser warning caused by automatic analytics injection.

2026-10-16/4204723

Your Lab Tenant, in the portal

New accounts get a Lab Tenant set up for the first lab when they sign up, and existing accounts get theirs the next time they open the site. It is the first entry in your account menu, marked Lab Tenant, and your own tenant is marked Personal Tenant. Labs that need a second identity provider add a Second Lab Tenant.
Labs now send you to your Lab Tenant's portal pages to make each change and to read Audit and Logs, instead of forms on the lab page. Each step links the page it uses, and what each lab checks is unchanged.
Starting a lab still rebuilds your Lab Tenant fresh for that lab, so you can do labs in any order. It is also cleared after 30 days without a Start or any use in the portal. Its tenant details say so, and it has no Reset of its own. Keep anything you want to last in your Personal Tenant.
Your profile has an Open by default setting, so the account menu and tenant pages can open your Personal Tenant instead of your Lab Tenant.
Tenant details have copy buttons for the tenant ID and hostname. Tenant details and BTL Admin's organization details no longer list the environment and store jurisdiction.
Rotating a client secret can now keep the old secret working for 3 minutes, long enough to watch the switch happen.

2026-10-16/ee4aea4

A turning globe and swaying drawings

A slowly turning globe is back behind the home page's title, and the three drawings under the introduction are now 3D objects that gently sway.
A pause button by the globe and another by the drawings stop all of this motion, and nothing moves if your device asks for reduced motion.

October 15

2026-10-15/8f432e9

Fairer lab checks

Steps about how you sign in now check the method you used, so a password sign-in no longer completes a step about an email link, a code, an authenticator app or a passkey.
Steps that must happen in order are now checked in that order, including a change to the lab tenant followed by a request, so an earlier event no longer counts toward a later step.
Renaming a client during a lab no longer confuses its checks or its forms, and a failed check in a shell step now stops that step with a message instead of closing your terminal.

2026-10-15/51846db

The home page is new: a short introduction with views of a lesson and its quiz, the six curriculum sections, diagrams you can switch between, Capture the Flag and the identity tools.
In the light theme, the home page's screenshots are light too.
The site uses a calmer, neutral colour palette, and the main navigation sits in the centre of the header with your current section marked.
The Learn sidebar shows your progress. Each lesson has a small square that fills in as you answer its questions, and each section counts the lessons you have finished. It updates as you answer, and when you are signed out it uses the answers saved in this browser.
When you are signed in, Log in becomes your profile button. Its menu holds your tenants, tenant management, your account pages and, for staff, BTL Admin, so the main navigation is the same for everyone.
On phones and tablets the header is just the name and a menu button, and the menu holds everything else.
Sidebars drop their all-caps section labels, and help links that are not available yet are hidden instead of greyed out.
Secondary buttons are now an outline that fills in when you point at them.
Diagrams scaled down to fit your screen show an Open full size button above the drawing.
In the JWT decoder, Decode sits right under the token, and checking the signature is an optional step you open after it.
Capture the Flag and the hosted labs use the new look.
Pages are now built with a new site framework. If anything looks broken, tell us through Support, or through the About page if you are not signed in.

2026-10-15/72268b6

Lab fixes after a full review

Every lab was checked again against how it is graded. Labs that could never be completed, or whose steps could not produce what they check, are fixed, including Signing keys and rotation, two access request labs and three certificate and key labs that now have steps you can complete.
Steps now offer the forms, requests and sign-in pages they need, and tell you when to choose Refresh on a form after something new appears.
Wording left over from the old tenant setup is gone, and expected outputs, step references and setup notes now match what each lab does.

2026-10-15/ce21d7d

A fresh lab environment for every lab

Every lab that uses a lab environment now has a Start button that builds a fresh one for that lab alone: a lab organization called Lab Photos, plus Lab Mail when the lab needs two, already set up with the people, applications and settings the lab uses. You no longer prepare a tenant, choose one, or finish earlier labs first.
Where changing a setting is the point of the lesson, the lab page shows a small form for exactly that setting, and you read Audit and Logs right on the page. Labs no longer send you to the tenant portal, and your own tenant is left alone for your own experiments.
Passwords, client secrets and keys a lab needs are shown once when you press Start. Starting again, or starting another lab, replaces the environment, so work on one lab at a time. An environment you have not started for a month is cleared, and your next Start builds a new one.
Labs graded as cases open their case when you press Start and no longer ask you to tidy up afterwards. Agent and service labs run their guided services from the lab page.
Each of those labs was rewritten for this, so it can be completed on its own, in any order.
Labs no longer use a free extra tenant. Creating more tenants of your own now needs a paid subscription, and any extra tenant you already have is kept.
Lab pages no longer list the lesson sections they practice, and each row in the Lab catalogue now labels its lab.

October 14

2026-10-14/a39c229

No page trails

Small labels and page trails above titles are gone everywhere. A lesson shows its place in the line under its title, and the sidebar shows the rest.
The home page's Create account button is hidden when you are signed in.
Radio buttons stay empty until you choose one, and quiz answer boxes line up with their answer.

2026-10-14/2ea677e

A new front page

The home page is new: a terminal window with the site name and a slowly turning globe drawn in text, a walk through what a lesson does using a real token, the six curriculum sections as a departure board with their lesson counts, and a closing start here.
The learning overview moved to /learn/. Learn links and the Overview link point there.
Spacing, buttons, checkboxes, radios, selects and scrollbars now follow one consistent style across the site.
Small labels above headings are gone everywhere, and exercise progress shows as plain text after the question.
The home page hides the side navigation and has the dark mode switch in its footer. Its motion can be paused from the top window, and stops when your system asks for reduced motion.

October 13

2026-10-13/d1e1327

Lesson review tracking by group

Lessons on the admin review page are now grouped by their Learn sections and groups.

2026-10-13/5231c16

Lesson review tracking

Added a page for admins to track lesson and lab progress.

2026-10-13/64b4758

Revisions to deployment process

Revisions to deployment process.

2026-10-13/5a23a2c

More reliable Lab and support recovery

Fixed fresh-tenant setup for the callback Lab and made partner examples follow the current environment.
Improved private support attachment recovery after interrupted storage and tightened safe Audit details.
Balanced quiz answer wording and documented browser storage used by owned Lab applications.
Updated release checks to match the current lessons, Labs and diagram tools.

2026-10-13/ee7bc3b

More complete identity Labs

SAML Labs now follow real sign-in responses, linked application accounts, sign-out across two applications and recovery from interrupted or refused requests.
Added native checkpoint kits for passkeys, application access, federation, customers and privacy. Real requests and fixed decision examples are identified separately, with diagnosis, repair and resource-preserving cleanup.
JOSE Labs can open a temporary token sample flow for their configured user and client. Updated technical Lab instructions follow the working controls and explain the source each checkpoint needs.
Improved keyboard focus in Lab controls. Completion checks now follow the current Lab definition, while older attempts retain supported inspection and cleanup.

2026-10-13/c14dd7e

More lessons and hands-on identity Labs

Added 37 lessons, questions and paired Labs covering SAML, JOSE, WebAuthn, application accounts, access in context, customers and guests, privacy, enterprise directories, and credentials and wallets.
Owned Labs now connect checkpoint results to actual protocol requests, service receipts and resource state. Dedicated example hosts support sign-in receivers, relying parties and workloads; the instructions cover diagnosis, repair, negative controls and cleanup. Decision simulations are identified separately.
Expanded tenant and BTL organization controls for directory profiles, authentication pacing, claims sharing, workload federation and guided services. Supported settings persist and affect the corresponding runtime, with current permissions checked independently in each organization.
Audit and Logs show more useful action, request and sign-in flow details, including retained history context. Personal history, tenant collection controls and request summaries make activity easier to inspect, while Usage shows the relevant registered limits.
Private support tickets synchronize replies, attachments and status with Discord under current access permissions. Staff account notifications and sync details help support follow the conversation.
Updated Lab instructions and command checks, retained the core progression documents, and clarified historical branding records. Fixed tenant page admission and an interaction where a hovered glossary definition could prevent an expanded diagram closing with Escape.

2026-10-13/f671491

Every lesson diagram in the new look

All 119 lesson diagrams are now drawn directly into the page in the window style: 75 sequence diagrams, 34 flowcharts and 10 side-by-side panels. They follow your light or dark theme, and their text can be selected and searched.
The illustrations in lessons are redrawn as diagrams too, with the same words and without the headings and taglines that sat above and below them.
On a phone or in a narrow window, a diagram keeps its full layout, scaled to fit. Tap it, or use Expand diagram, to open it full screen at its own size.
The JWT and SAML assertion grants lesson no longer shows a second picture of the exchange its diagram already draws.

October 12

2026-10-12/f029596

Diagrams drawn in the new look

Two lesson diagrams are now drawn directly into the page in the new window style: the sign-in sequence in "Following a complete sign-in", and the checks at each trust boundary in "Trust boundaries". They follow your light or dark theme, fit narrow screens, and their text can be selected and searched.
More diagrams will move to this style in batches.

October 11

2026-10-11/f526fa7

A new display typeface

Titles and headings across the site now use Martian Mono, a typeface that matches the window-style look. This covers lesson, lab and docs headings, changelog entry titles, the sign-in tagline, and the digits on the verification code screen. Body text stays as it was, and so does the logo.
The verification code field now shows its digits at a fixed width, as it was meant to. A style conflict had been overriding it.

2026-10-11/b33aa77

Squarer, clearer icons

Icons across the site now come from one consistent set, drawn with square corners and ends to match the new look. This covers the header menu, the curriculum sidebar, the tenant and account navigation, the help panel, the theme switch and the upvote button.

2026-10-11/94318fb

A new look across the site

The site now uses the new Beyond the Login look: square corners, flat surfaces with a thin edge in place of shadows, and the two-tone stacked windows mark in the header and the browser tab.
Lime now marks where you are. The current page, lesson and tab are filled lime, and links, buttons and small labels use the new colours in both themes. Light mode uses a deeper lime so it stays clear on the paper background.
Body text is a little larger, and lesson text is larger again, so long lessons are easier to read.
Account avatars are now drawn in colour at every size.

October 10

2026-10-10/ebedf16

Groundwork for a new look

We've documented a new visual identity for Beyond the Login: a new mark, colours, type, window-style graphics and patterns, along with the references behind them. The site itself doesn't change yet; the new look will arrive in later updates.
Anyone contributing to the site now has one place to find the brand guidelines.

2026-10-10/f27d5ad

More independent labs and troubleshooting practice

Labs introduce the people, tenant and tools before using them. Training paths now link the background needed for advanced exercises, and familiar procedures move into reminders you can open whenever you need them.
Optional extensions no longer block a lab's core completion. Completed attempts keep their credit after cleanup, while restarting requires fresh activity.
Revised lesson explanations, examples, quizzes and diagrams make validation, delegation and failure cases clearer. Changed quiz questions may ask for a new answer.
New Troubleshooting lessons and paired labs cover common workplace failures, including expired federation credentials, invalid scopes and refresh-token expiry. Each lab identifies the work available today and any parts still planned.
CTF practice has clearer preparation, target instructions, evidence and repair checks. Requested hints and explanations return when you reload, and unavailable services show useful feedback without retrying actions automatically.
Tenant administrators can choose client-secret expiry and shorter refresh inactivity periods for their own clients and token managers, making expiry and recovery exercises repeatable.
The lab toolkit and protocol examples stop when validation fails, and passkey sign-in details describe the authentication method more accurately.

2026-10-10/44d0043

Simpler lesson questions

Removed the "Put it into practice" label, answer-count box and routine "Saved to your profile" notice from lesson quizzes. Answer feedback and progress saving still work.
In "What is Identity?", the link to the next lesson now follows the lab and quiz.

October 9

2026-10-09/618a32f

Revised changelog entry planning

Updates that only add or revise our internal planning notes no longer appear in this changelog, since they don't change the site.

2026-10-09/63f53ff

The Lab is now for signed-in members. If you open a lab while signed out, you are asked to log in or create an account, then taken straight back to that lab.
Lessons are still open to everyone. The "Try it in the Lab" card at the end of a lesson now says when you need to sign in first.
The lab toolkit and the files that lab steps download from the command line still download without signing in, so existing setup commands keep working.
Lab pages no longer appear in search engine results.

2026-10-09/9e8faa9

Tenant management waits for a new tenant

If your personal tenant is still being created when you open tenant management, the page now says so and opens your tenant on its own when it is ready, instead of reporting that management is unavailable.
New staff accounts start creating their personal tenant as soon as sign-up finishes, so the wait is shorter.

2026-10-09/b462450

Labs that build step by step

Every lab was reviewed against its lesson and rewritten where needed. Each one now practices what its lesson teaches, and labs get harder only as the lessons do.
The Identity fundamentals, Identity proofing, Authentication methods, Authorization, Identity governance and Identity security labs now run entirely in your browser and your tenant portal. You won't need a terminal or protocol knowledge for those lessons.
Labs no longer ask you to build or exchange OAuth and OpenID Connect requests before the lesson that explains that step. Earlier labs let you watch the exchange in the Token Decoder instead.
Credentials and keys now comes after Technical foundations, and Certificates and PKI now opens the specialist topics, so each group follows the skills it uses. Training paths now include the lessons their labs rely on.
There is now one lab toolkit, installed once in Building your identity lab toolkit, which also installs Node.js 22. It adds a version check, readable token decoding, one-step sign-in links and pushed authorization requests. The terminal labs support Ubuntu 24.04 and macOS 14 or later.
Lab pages now link straight to your own tenant once you choose it. They count each progress step on its own, and they can send SCIM requests from the request console without ever showing you a token.
Tenant administrators can now see the result of each authorization test in Audit, filter protocol activity by person or session, and create a Shared Signals stream from Flow policy.
What browsers add now introduces browser developer tools.
Several labs that could not be completed as written now can.
If you finished Building your identity lab toolkit before this change, its new steps show as not done. One quiz question there, and one in Clients, servers, and addresses, changed and will ask for a new answer.

October 8

2026-10-08/8babbba

Quieter email verification page

The email verification page no longer shows a placeholder status line while it waits for your code. Status messages still appear when something changes, such as a verified, expired or locked registration.

2026-10-08/d9dfc07

Tenants are open to every account

Every verified account can now open Tenants from the navigation and manage its own tenant, including its users, roles, OAuth clients, settings, Audit and Logs.
Labs that run in a tenant you manage now work for every signed-in account, not only for BTL staff.
Each tenant stays private to the people it authorizes. Having a tenant gives no access to anyone else's tenant or to BTL administration.

October 7

2026-10-07/738bbce

Fix CTF Practice and directory roles in tenant management

The CTF Practice page in tenant management now loads your organization's practice settings and challenges, instead of showing "Not found."
The Directory roles section of User Management can load and save roles again.
Added a check that stops a tenant management page from being left unreachable this way in future.

2026-10-07/faad6cb

Capture the Flag challenges and organization practice

The Capture the Flag track lets you investigate disposable identity applications, capture a flag, explain the flaw, apply a repair and retest the normal flow.
Sixteen challenges cover browser, token, federation, provisioning, authorization and delegation mistakes. Each attempt has its own sandbox, and tenant administrators can set up organization practice.
Your profile shows CTF progress, and related activity appears in your organization's Audit and Logs. Completing the track can award the CTF Champion role in a connected Discord server; managed learner roles now appear in separate member sections.

2026-10-07/b8e856d

Clearer lab setup, passkeys and security history

Lab Prepare now waits for you to choose its tenant before reading settings and refreshes Setup values when you change tenants. A governance lab checks that self-service email change was switched on and later off.
The Privacy Policy explains what tenant identity proofing stores and when that information expires. Audit and Docs now say when disconnecting an application or revoking a token also ends tokens exchanged from it.
Site passkeys can satisfy a sign-in step on a BTL user's own tenant host. SAML sign-ins use each tenant's configured authentication-context order, and refusals that need a recent sign-in identify the reason more clearly.
Support actions and HR Simulator outcomes are recorded more reliably.

2026-10-07/618575b

A note from Chris on the About page

The About page now opens with Chris's welcome note and a link to the community Discord.

October 6

2026-10-06/7493dcf

Fixes from a full review of the site, the identity service and the labs

Prepare this lab now works in a new or reset tenant for every lab, and the labs that could not be finished now can be.
Support changes to people's accounts need a recent sign-in, support can no longer choose someone's password, and sign-in, password and recovery protections are tighter in several places.
The identity service follows the OAuth, OpenID Connect, SAML, SCIM, LDAP and Shared Signals specifications more closely. New settings cover ID token signing, which client may act for users, the NameID format, and Shared Signals streams.
Lessons start with Identity fundamentals again, training paths show the next lesson on your path, and many lessons, quizzes and illustrations are corrected.
Buttons keep keyboard focus while they work, small controls are easier to tap, and the Security page explains when its settings cannot load.
The Privacy and Cookie Policies now describe support tickets, ideas, tenant users, every email we send and every cookie we set.
BTL administrators can set how long people stay signed in, see the BTL organization's usage, and choose whether people can change their email address.

2026-10-06/845e768

Change reasons and help desk recovery proofing

Tenant administrators can now choose a list of reasons for changes to people, groups and roles, and require one, in the portal and over SCIM. Each reason is recorded with the change in Audit.
Someone who has lost every way to sign in can now prove their identity on a recovery page using a one-time code from your help desk, within a time window you choose. You can require this before anyone resets their sign-in methods.
The help desk recovery and governance evidence labs are now ready.

2026-10-06/a06871f

Labs checked against the latest lessons

Labs now match the latest lessons and the tenant portal's current page names, buttons and settings, and steps that could not be completed as written have been fixed.

2026-10-06/8eb0471

Clearer Logs, separate from Audit

Logs now show how each request to your tenant was handled, including its status, timing and where it failed, while Audit stays the record of who changed what.
Open a request log record and choose View this request to see everything recorded for that request in one place.
Your tenant's usage view now shows how many request records were collected today, and Logs say when some were left out.

2026-10-06/097a0c7

Alerts for emergency and sensitive access, and the updated_at claim

Security alerts now flag emergency access as soon as it is given, and access to a high-sensitivity catalog item through a request or activation, so administrators can review it quickly.
ID tokens and UserInfo can now include updated_at, the time a person's profile last changed.
The emergency access, claim stability and FAPI conformance labs are now ready, and the provisioning lab now shows accounts created just in time through a sign-in provider.

2026-10-06/683bf7d

Workload and agent identities lessons

Fourteen new lessons in Specialist topics explain how services, pipelines and AI agents get identities of their own, prove who they are without stored keys, act for people with narrow and approved authority, and are traced, stopped and retired.
Two in-lesson simulations let you test a pipeline trust condition and judge whether an approval request is enough.
Every lesson has a lab. Two are ready to do in your own tenant: splitting a shared client into one identity per service, and recording an owner for each client, rotating a leaked secret and retiring a client nobody owns. The others show what is planned and what you can practice today.
A new training path and glossary entries cover the section.

2026-10-06/35189ea

Tenant administrators can now preview a sign-in requirement, such as a passkey for everyone who manages the tenant, in report-only mode. Sign-ins carry on as before, and Governance reports show who would not have met it, so people can be helped before it is enforced.
Redirect URIs and response types can be marked for removal in a client's report-only settings, so you can see who still uses them before they stop working.
A confidential client can be allowed to send a redirect URI it never registered, only in a pushed authorization request and optionally limited to an address prefix. It is off by default, and Audit records each address used.

2026-10-06/8b357f7

New Tools section

A new Tools section brings together small tools for everyday identity work: a JWT decoder, a SAML decoder, a PKCE and state generator, an authorization request builder, a discovery document and JWKS checker, a certificate chain inspector, a SCIM payload validator and a policy playground.
Each tool explains what it checks and why it matters. Tokens, certificates and messages you paste are checked in your browser and are not sent anywhere; the discovery checker fetches documents only from the address you enter.
The policy playground lets you edit the newsroom rules from the Authorization lessons and follow each decision rule by rule.

2026-10-06/6961b42

Join the Beyond The Login Discord

There is now a Beyond The Login Discord server where you can ask questions, get help with labs and share what you build. Anyone can join.
Connect your Discord account from the Discord community card on your profile to receive roles that show your progress: a rank that grows with the number of labs you complete, and a badge for each section of the curriculum you finish.
Your roles update on their own shortly after you complete a lab. You can also refresh them from your profile or with /sync in the server, and /rank shows your progress to you alone.
We keep only your Discord user ID and username, never a Discord sign-in token. Disconnecting, or deleting your account, removes the roles we gave you. The Privacy Policy explains what Discord receives.

2026-10-06/9abb22b

Technical foundations comes first

Technical foundations now opens the Foundations section, in both the lessons and the labs. You can set up a terminal and learn the web skills the labs use before the identity labs that rely on them. It is still optional if you only want the concepts.

October 5

2026-10-05/9cf19e3

Tenant administrators can now choose how sign-in responds to repeated wrong passwords: slow down guessing from the network it comes from, which stays the default, or lock password sign-in for the account for a set time. Both let you choose how many attempts are allowed and for how long.
With locking, you can email people a link that unlocks their account. A completed password reset also ends a lock, and administrators who can unlock users can lift one from User Management.
Locks, unlock emails and administrator unlocks appear in your tenant's Audit and Logs, and the Usage view shows how many addresses are being held back. Beyond the Login accounts keep slowing guesses per network, so nobody can lock a BTL account just by knowing its address.

2026-10-05/100b7f8

Find your way through the curriculum

The lessons are now organized into five sections: Foundations, Sign-in and federation, Access and governance, Identity security, and Specialist topics. Advanced OAuth and OpenID Connect material moved to Specialist topics, so the core lessons read straight through.
Every section and group has its own page listing its lessons, reading times and labs, and every lesson shows where it sits and which earlier lessons it builds on, so you can start anywhere.
New Start here, Training paths, Glossary and Who's who pages help you choose where to begin and look up terms and recurring characters. Lessons link the terms they use without explaining to the glossary.
When you are signed in, the quizzes you complete are saved to your account instead of this browser, and lab progress is no longer kept in the browser either. A new Learning tab on your profile shows your progress along each training path, and progress saved in a browser before you signed in can be added to your profile when you choose.
Two new lessons, Clients, servers, and addresses and Keys, encryption, and signatures, open the fundamentals to readers with no technical background, and several early lessons now introduce one idea at a time, with technical detail in sections you can skip.
Each lab now lists the labs it builds on, and Prepare this lab sets up much of the starting state in your lab tenant, such as the Lab Photos preset, clients, people, roles and groups, so you can start most labs without doing the earlier ones. Steps it cannot set up yet, such as enrolling sign-in methods or registering keys, are listed for you to do by hand. Shared commands moved into the lab toolkit.
Planned topics such as SAML, signed and encrypted tokens, passkey internals, zero trust, privacy, workload and agent identities, and verifiable credentials now have places in the menu.

2026-10-05/24be96c

Technical Foundations: the terminal, networking and HTTP, from your own computer

A new Technical Foundations course now comes before Identity fundamentals. Its 16 lessons start with setting up a terminal on Windows (with WSL), Linux or macOS. They build up through files, pipes, variables, text tools and scripts, then DNS, raw HTTP, curl, JSON, encoding and hashing, HTTPS certificates, and what browsers add with CORS and cookies. The course ends with the command-line toolkit the identity labs use.
Every lesson has a lab you run in your own terminal against a new practice service. Steps count toward your progress when the service receives the requests a lab asks for. Nothing watches your computer, and you only send what you choose to.
Lessons and labs show the steps for your computer. Choose Ubuntu or macOS once, and your choice follows your account to every device.
A new Lab keys tab on your profile creates and revokes the keys that let the practice service record your progress. A lab key works only for lab progress, expires after 30 days, and is revoked automatically if it is ever sent without encryption. Creating, revoking or a refused use of a key appears in your account history.
Your Usage tab shows the new practice limits. The privacy notice explains what the practice service keeps, and your keys, notes and practice records are deleted with your account.

2026-10-05/4e5d06f

The Lab sidebar now uses the same sections as Learn. Each lab sits under its lesson's topic and subtopic, so OAuth 2.0 and OpenID Connect open into groups such as Foundations and The authorization code flow instead of one long list.
The All labs page groups each series the same way. Each group shows how many of its labs are ready, and the groups around a lab you're working on open automatically when you return.

2026-10-05/e3eb651

Platform metrics for BTL staff

BTL staff can see how many people use Beyond the Login, how membership changes over time, and how often each lab is started and completed, on a new Metrics page in BTL Admin.
Membership history is now kept as memberships begin and end, so member counts and churn can be measured for any month. When an account is deleted, its membership history no longer identifies the person.
Every lab start, including starting again, and every completion is now counted without recording who it was.

2026-10-05/2db59a8

Identity proofing practice in your tenant

Your tenant can offer a clearly labeled identity proofing simulation. People choose made-up sample documents, selfies and records, never real ones, and prove who they are through a document and selfie, a record check with a simulated letter, or a trusted referee.
Administrators choose which routes to offer and the assurance level each reaches, set the face match threshold, decide whether unclear results go to a referee, and choose which verified details are released. People with a referee role decide unclear applications and every Trusted referee application, and each decision is recorded in Audit.
Authentication levels can now require identity proofing, so applications can ask for a proofed person, and tokens can carry verified claims in the OpenID Connect for Identity Assurance format. Revoking a person's proofing record stops new tokens from claiming it.
The identity proofing labs now run against your own tenant, and a new Docs page explains the feature.

2026-10-05/3bd016b

Govern who has access, and change policies and provisioning with less risk

A new Governance page lets you offer access in a catalog, have people ask for it with a reason, route each request to the right approvers, and give access for a set time or just in time, with an emergency option that is reviewed afterwards. Nobody approves their own access, two approval steps always need two people, and each decision can be traced end to end in Audit.
People ask for access and review it on your tenant's own Access and Reviews pages, decide what is routed to them on the Approvals page beside their sign-in requests, and can be told by email when something waits for them. Access reviews put access with no recorded reason first, remove access at once when a reviewer says so, and escalate undecided items instead of counting them as kept.
Access rules keep group membership in step with people's attributes, such as their department, with a guard against large accidental removals. Separation-of-duties rules stop one person holding conflicting access, with owned exceptions that end on a date. Start dates, end dates and leave close and reopen accounts on time, and a sponsor can extend or confirm a contractor's end date.
Groups can give management roles, and a role can be given for only part of a tenant, such as the members of one group. When a change is refused because someone tried to hand out a permission they do not hold, Audit now says so and names what was missing.
The Authorization page keeps versions of your policy changes that you can compare and roll back, runs saved tests that can stop a breaking change, and can try a candidate policy beside the live one on real requests before you switch.
Your tenant can keep accounts in the sample photo app in step through its SCIM interface as people join, change and leave. An attribute such as department can be reserved for the provisioning client that is its source of truth, and signed-in users can read their own record at /Me. A teaching LDAP endpoint answers directory binds and searches over HTTPS.
A Reports tab shows who has not signed in, how each application uses your tenant and when its secrets were last used, and the owners you record for applications, accounts, groups and roles. Before requiring PKCE or retiring a grant that applications use at the token endpoint, you can count who would be refused.
Many governance, role, policy, directory and provisioning labs now run against your own tenant.

2026-10-05/4ad0dd3

Certificate authorities for your clients, and mutual TLS

Under OAuth Management, Certificates lets you run a teaching certificate authority for your applications: paste a certificate request to issue a client certificate, renew it, and revoke it, with a public certificate and revocation list for each authority. You can also trust an outside authority, such as a partner's, by importing its certificate.
Turn on mutual TLS in Flow policy to give your tenant's token, introspection, revocation and UserInfo endpoints, and the sample photo API, a second address where applications present a TLS certificate. Applications can then authenticate with a certificate instead of a secret, from a trusted authority or registered in their own keys.
Applications can ask for access tokens bound to their certificate, which your tenant's APIs accept only from a connection with that same certificate, so a copied token is useless. Resources can require such tokens, and the FAPI 2.0 profile accepts mutual TLS.
The certificate and mutual TLS labs, and the token theft and replay lab, now run against your own tenant, and the lab toolkit can print a certificate's thumbprint and key set.

2026-10-05/9003f3b

Sign in through other providers, SAML applications and encrypted responses

Your tenant can trust another OpenID provider or SAML identity provider. People connect an existing account by signing in to it again, or get a new account at their first sign-in when you allow it. A matching email address never connects accounts on its own. Sign-ins through a provider appear in session lists and count for security alerts.
Your tenant can sign people in to SAML applications, with published metadata, signing key rollover, and sign-out requested by an application that signs its requests.
Applications can receive ID tokens, UserInfo responses and authorization responses encrypted to their own key, and can send encrypted request objects. UserInfo responses can also be signed, and applications that register themselves can choose these too.
UserInfo can include claims held by another provider, either as that provider's signed statement or as a pointer to where to fetch them.
People can open their applications from a new Applications page. An OpenID Connect application starts its own sign-in, and a SAML application receives the sign-in directly.
Applications can exchange an assertion from a trusted SAML provider for an access token.
New Docs pages, lab toolkit commands and labs that run these flows against real tenant requests.

2026-10-05/d964867

Verified passkey models, session support and alert emails for managers

Tenant administrators can now require each new passkey to prove it is a genuine, certified authenticator model with no known security problems, checked against a signed industry list that Beyond the Login refreshes daily. The setting is off by default and is on the Authentication page.
BTL Admin can now see where any Beyond the Login account is signed in and sign one browser or every browser out. Each view and sign-out is recorded in BTL Audit and in that account's own organization.
Security alert emails now also reach Beyond the Login accounts that manage a tenant they do not live in, at the address on their account.

2026-10-05/ceddb2e

Sessions, sign-out, security events and alerts

Choose how your tenant handles sessions and passwords: an idle timeout that signs people out after a period without use, password rules for length, kinds of character, reuse, breached passwords and age, and which passkey models people may add. People see where they are signed in on their Security page and can sign other browsers out, and administrators can do the same for a user.
Applications can sign people out through your tenant and send them back to an address they registered. When a session ends for any reason, applications that asked are told in the browser or server to server, and ID tokens name the browser session they came from. Applications that register themselves can register these addresses too.
Your tenant can tell applications about revoked sessions, changed credentials and locked, unlocked or deleted accounts as they happen, using the Shared Signals standards, by push or by polling.
Applications without a browser redirect, such as a kiosk, can ask a person to approve a sign-in, which they answer on a new Approvals page in their account. You can also let people finish their second step from another browser where they are signed in, by choosing the number the sign-in shows.
Audit records now show where each sign-in and request came from, without storing network addresses, and people can report a sign-in that was not them. A new Alerts page lists security alerts from detection rules you can turn on and tune, and can email administrators a summary.
Export Audit and Logs history as CSV or JSON, and place legal holds that keep records longer than the usual 30 days.
Each tenant has a lab receiver that plays an application receiving these messages. New Docs pages explain each feature, and the session, logout, signals, backchannel sign-in, detection and investigation labs now run against them.

2026-10-05/3c8a6ff

Applications can register themselves

Turn on client registration under OAuth Management, Registration, so software can register its own OAuth clients through the standard registration API, and later read, update or delete its registration. Registration stays off until you turn it on.
Protected registration needs an initial access token you create, which can limit the redirect addresses and how many clients it registers; you stay accountable for every client registered with it. Open registration lets any software register, within limits per network.
Trust software statements from publishers you choose: their signed values win over the rest of the request.
Decide what registered clients may receive, how long their secrets last, whether values outside your policy are left out or refused, how many clients can register and how often, and whether registrations unused for a while are removed. Registered clients are marked in the Clients list and on the consent page.
The lab toolkit can sign your own claims, and the client registration labs now run in your tenant.

2026-10-05/97f604d

Protected sign-in requests, key-bound tokens and finer-grained access

Applications can send their sign-in request to your tenant first, or sign it with their own key, so nothing can change it on its way through the browser. Flow policy can require pushed requests from every application except the built-in Token Decoder, and each application can require either.
Tokens can be bound to a key the application holds, so a copied token is useless on its own. UserInfo, SCIM and your tenant's built-in APIs check the binding, and you can mark an API as accepting only bound tokens, which the sample photo API enforces.
Sign-in responses can come back signed by your tenant, so applications can confirm where they came from. Signing keys can now also use PS256 and EdDSA, and applications can register Ed25519 keys.
Applications can ask for exactly what they need, such as one album, with authorization details types you define. Tokens carry the details, and people see them before they agree unless you trust the application to skip consent.
An application, or every application except the built-in Token Decoder, can follow the FAPI 2.0 security profile, which makes these protections mandatory together.
New Docs pages explain each of these. Most labs for pushed requests, request objects, DPoP, signed responses, authorization details and FAPI are now step-by-step exercises with automated checks, and the lab toolkit can sign request objects and DPoP proofs.

2026-10-05/ac326ef

Stronger sign-ins on request, more ways for applications to sign in, and connected applications

Define authentication levels in Flow policy, each named for the sign-in methods it needs. Applications can ask for a level, people are asked for a stronger sign-in when they need one, and tokens say which level was met. You can also require a level before people who sign in to your tenant change their password, sign-in methods or email address, or manage the tenant from its own pages.
Applications can ask for individual claims, receive a different user identifier in ID tokens for each group of applications, and show their logo and policy links on the consent page. Native applications can use their own app redirect schemes. People can allow access one scope at a time, and new users can register from an application's sign-in request.
Tokens can carry groups, directory roles, custom attributes and how the person signed in. Directory roles are now created and given to groups on the Groups page.
Confidential applications can authenticate with a secret in the request body or with an assertion signed by their own key. Secrets can be rotated with an overlap, so applications switch without an outage.
New grants: device sign-in with a short code, JWT assertions from identity providers your tenant trusts, and token exchange for services that act for a user.
People who sign in to your tenant can see and disconnect the applications connected to their account on its Security page, and administrators can do the same for any user. A tenant can also allow only applications an administrator approved. Withdrawing approval stops new sign-ins and refreshes for that application at once, even for people who allowed it before.
Every account can now create an extra lab tenant, which the labs use as a second identity provider. Many labs were rewritten to use these features.

October 4

2026-10-04/a5e225f

Protect your own APIs and decide what users may do

Register the APIs your tenant issues access tokens for under OAuth Management, Resources. An application can name the API it wants a token for, and the token then works only there, with only that API's permissions.
A new Authorization page lets you decide what people may do inside your applications, using relationships, roles and rules. It shows why each answer was given, and your applications can ask it for decisions too.
Each tenant can turn on a sample photo API to practice against. It checks tokens the way a real API does, explains every refusal, and follows your authorization rules for every album and photo. The Lab Photos preset sets it up with sample albums.
The labs on resource indicators, API metadata, resource servers and authorization now run against these features in your own tenant.

2026-10-04/aaf0e15

The header stays put between pages

Moving to another page, or going back to one, no longer briefly empties the header of your tenant switcher and account links before they reappear.
Your current tenant's name now shows as soon as a page opens instead of a placeholder, and header text no longer switches fonts as each page loads.
We also recorded our plans for separating tenant Audit from Logs and for a Technical Foundations course, so upcoming work can build on them.

October 2

2026-10-02/b105d0d

Delete your account

You can now delete your account from your Profile page. Type your email address to confirm, and sign in again if asked. Your account goes together with your personal tenant and everything in it, along with your lab progress, ideas and support tickets. You are signed out everywhere, and the address can be used to sign up again.
BTL support can delete a member's account from BTL Admin with a new, separately granted permission. Every deletion and every refused attempt is recorded in BTL Audit.

2026-10-02/ccb8956

A hands-on lab for every lesson

Every lesson now has a lab: a step-by-step walkthrough in your tenant with real requests, real settings and the real events your tenant records. Labs that depend on features not built yet show exactly how they will run and what you can already try, and labs that also need a second tenant say so. These labs replace the earlier ones, and earlier lab progress was not carried over.
Start a lab in a tenant you manage and check your progress at any time. The lab compares your tenant's own Audit records with each step, in order, after you press Start.
Lab pages can send their example requests to your tenant from the page, and a new lab callback page shows what an authorization server sent back without keeping or sending it anywhere.
The lab toolkit, a small command-line helper for PKCE values, callbacks, token validation, introspection and a local practice API, is available to download with its checksum.
Tenant Admins signed in with their Beyond the Login account can reset a tenant to a clean start. Audit and Logs history is kept by default, clearing it needs its own permission, and the reset can set the tenant up for the labs.
Fixes and refinements: SCIM userName filters now find every user, revoking a token issued to another client is now refused instead of silently doing nothing, token managers can allow a short grace period for a client retrying a lost refresh response, and tenant pages refuse framing in older browsers too.
Claim names reserved for protocol features can no longer be set by claim mappings or token policy scripts. Existing mappings that used them were removed and recorded in Audit, and a token policy script that sets one stops issuing tokens until the claim is removed from it.

2026-10-02/64ce4bb

Your account now lives in your own tenant

Every account now lives in its owner's personal tenant, the same way a tenant's own users do. You sign in on the site as before, and you can also sign in on your tenant's own address with the same password.
Your Profile page lets you change your name, and your email address after you confirm a code sent to the new address.
In a tenant's Users list, Beyond the Login users now appear alongside tenant users, marked by type. Their name, email and sign-in methods stay under their own control, and tenant administrators manage only their roles.
BTL support can now lock an account, give Beta Access, reset sign-in methods and help inside a member's tenant. Each support action is recorded in that tenant's Audit.
Accounts created before this change were cleared as part of the move, along with their support tickets, ideas and lab progress, so you will need to sign up again.

2026-10-02/8ccfbe0

Previous and Next now follow the menu through every lesson, so the last lesson of each section leads straight into the first lesson of the next.
On phones, wide lesson tables now scroll inside their own area instead of stretching the page, and long addresses in quizzes wrap to fit.
Planned labs stay out of search engines until they open, and two lab descriptions were corrected to match their steps.

2026-10-02/ba754aa

A new Learn section on identity security

24 lessons follow one fictional incident at Cedar Inc. through identity threats, account takeover, sessions, tokens and trust, privilege and persistence, detection and response, and building identity systems that hold up under attack.
Lessons include clearly labeled simulated exercises and diagrams of the key attacks and responses, and each ends with a short quiz.
The Lab has a new Identity security track with planned exercises and a guided review of your own test tenant.

2026-10-02/731ad99

The rest of the OAuth 2.0 lessons

84 new lessons complete the OAuth 2.0 section: tokens and resource servers, application architectures, security and failure cases, fifteen groups of advanced topics, implementation and operations, and the history of OAuth with guidance on moving away from older approaches.
The lessons continue the photo printing story with annotated requests, responses and tokens. They link back to the lessons they build on, sixteen include sequence diagrams, and each ends with a short quiz.
The Lab's OAuth track lists twenty more planned exercises for these lessons.

2026-10-02/d11f75a

New lessons on authorization and policy

Fourteen new lessons explain how applications decide what each person can do, following a fictional newsroom's photo library: designing permissions, checking access to each object, roles and their scope, safe role administration, rules based on attributes and context, access through relationships and sharing, and how policies are evaluated, enforced, tested and changed.
Each lesson ends with a short quiz, and four new diagrams show role assignments, where attributes come from, a relationship graph and one access decision from request to answer.
The Lab has a new Authorization and policy track with four planned labs, and two existing labs now link to the lessons they practice.

2026-10-02/e5824af

A new Learn section on identity governance and administration

21 lessons follow a clinic's staff through joining, changing jobs, and leaving, and through directories, provisioning with SCIM, access rules and requests, roles, separation of duties, access reviews, and audit evidence.
Every lesson ends with a short quiz, and diagrams illustrate the key flows.
The Lab lists planned hands-on exercises for this section.

2026-10-02/1bc761d

Feature flags and Beta Access

BTL administrators can now turn platform features on or off from a new Feature Flags page. Each change is confirmed first and recorded in BTL Audit.
The first flag, Beta Access, gives new accounts a Beta Access role when they sign up while the flag is on. It starts off, and we'll use it to offer member features free of charge as they arrive.

2026-10-02/d1ee0cc

OpenID Connect lessons

Added the OpenID Connect series to Learn: 55 lessons that continue the photo printing story from the OAuth lessons and show how an application signs people in through another service.
The lessons cover the sign-in exchange, checking ID tokens, provider discovery, claims and the UserInfo endpoint, accounts and sessions, controlling how people sign in, and signing out across applications, followed by advanced extensions and guidance for building and testing.
Every lesson ends with a short quiz, and a new OpenID Connect track in the Lab lists seventeen planned exercises.

2026-10-02/ed457fd

A second sign-in step now always uses a different kind of method from the first, so an email code no longer counts as a second step after signing in by email.
Wrong second-step codes are now limited for the whole account, not just one sign-in attempt, and failed password attempts from one network no longer lock you out when you sign in from another.
Changing or resetting a password now also signs out the apps connected to that account, and new passwords are checked against known breached passwords wherever they can be set.
BTL administrators can reset a BTL account's sign-in methods for someone who has lost access. Sensitive administrative actions now ask you to confirm it is you if you have not signed in recently, and accounts with administrative roles are signed out sooner when idle.

2026-10-02/ed457fd

OAuth and OpenID Connect follow the standards more closely

A user's subject identifier now belongs to that user for good, the sign-in details in ID tokens always reflect how the user actually signed in, and UserInfo returns the same subject as the ID token.
ID tokens are now signed with RS256 by default, and requests that use max_age, prompt=select_account or id_token_hint behave as OpenID Connect describes.
Browser applications can now finish the authorization code flow from their own site, native apps can use any loopback port, and a confidential client can be allowed to check other clients' access tokens as a resource server.
offline_access is now a built-in scope, refresh tokens can have an overall lifetime, and renaming a client or editing a scope's description no longer signs its users out.

2026-10-02/ed457fd

SCIM follows the standard more closely

Bulk requests, PATCH filters, primary email changes, version tags and sorting now behave as the SCIM standard describes, and the bulk example in the SCIM guide completes cleanly.
When a user's email address is changed in the portal or over SCIM, the new address must be confirmed before it can be used to sign in. Changing an existing user's email, in the portal or over SCIM, now needs the same permission as setting their password.

2026-10-02/ed457fd

Tenant Recovery keeps revoked access revoked

Restoring a tenant to an earlier time now signs everyone out and applies again the security changes made after that time, such as locked users, disabled keys and rotated secrets, so a restore cannot bring back access that had been removed.
The tenant's Audit now shows the time it was restored to, and tenant administrators who sign in on the tenant's own address can read its Audit and Logs.

2026-10-02/82d65cd

Lessons reviewed for accuracy and flow

Lessons across the curriculum were checked against the current standards and guidance, with corrections to certificate revocation, password guidance, passkeys, identity proofing and several OAuth details.
History of SSO now ends with a quiz, the refresh token grant now opens the Other grants lessons, Why use the authorization code flow? was rewritten, and repeated forward references were combined so each lesson reads more smoothly.

2026-10-02/ed457fd

Docs, Labs and the Token Decoder

The Token Decoder now offers only the response types your tenant allows, explains why a refresh token was or was not issued, and checks more of each response and ID token.
Planned labs now list what they still need, and the Docs overview and Architecture pages describe the site as it is today.
Correction: the 2026-10-01 entry about the OAuth client lessons said they link two existing labs. Those labs are planned, not yet available.

October 1

2026-10-01/749196f

Tenant Recovery shows times in your time zone

Tenant Recovery now takes the restore time in your own time zone and shows the UTC equivalent as you pick it. The confirmation and the list of restores show both.
After you enter a tenant ID, the page shows the range of times that tenant can be restored to, and only lets you pick from it.

2026-10-01/1b16e69

BTL support can restore a tenant to an earlier time

BTL support can now restore a tenant's data to how it was at any point in the last 30 days, for example to recover from an accidental change. The tenant's Audit and Logs history is kept through the restore.
While a restore runs, usually for a few minutes, the tenant shows that it is briefly unavailable for maintenance. Its Audit then records that BTL support restored it.
Storage for the live site's HR Simulator and support ticket attachments is now set up ahead of its release.

2026-10-01/368a242

Unnamed tenants show a shorter label

A tenant you haven't named yet, such as your first one, now shows as the start of its ID, for example "4213cb58", instead of repeating "Tenant" next to the Tenant label.

2026-10-01/e7461d2

On wider screens, sign-in pages now show just the sign-in form, without the floating account and help card. Help links, your profile and the theme switch remain in the menu on small screens.

2026-10-01/48926a8

New lessons on OAuth clients and registration

Five new OAuth lessons cover how applications are registered and how they prove who they are: client IDs and registration, redirect URIs and client metadata, client authentication methods, secrets and signed assertions, and rotating client credentials.
Each lesson walks through annotated examples, such as requests, responses and client metadata, and ends with a short quiz.
The Lab catalogue links two existing labs to these lessons and lists three planned labs that will practice them.

2026-10-01/a6e3552

Development now runs separately from the live site

The development version of Beyond the Login moved to beyondthelogin.dev and now runs in its own hosting account, fully separate from the live site at beyondthelogin.com.
Development tenants now use addresses on beyondthelogin.dev. Accounts, tenants and data from the old development address don't carry over, so sign up again there to keep testing.
With the two environments separated, the live site can host tenant addresses of its own when tenant features are released there.

2026-10-01/61d4b4d

Clearer OAuth errors from tenant services

A tenant's token, revocation and introspection services now return the specific standard error for each problem, such as a scope the client can't request or a grant it isn't allowed to use, each with a consistent description.
When a request fails on the server, the response includes a reference ID that the tenant's administrators can look up in the tenant's Logs.
A sign-in request that stops on a tenant's address now shows a page naming the problem and its error code.
Refresh requests can ask for fewer scopes than originally granted, and public clients can revoke their own tokens.
The HR Simulator shows the reference ID and a link to the tenant's Logs when a token request fails on the server.

2026-10-01/3f68062

The Lab catalogue pairs each lesson with its labs

Each Lab track now lists its lessons one per row, with the labs that practice each lesson beside it and their status.
The card that pointed to your next lab is gone. Instead, the track holding your next lab opens automatically, and signed-out visitors see a short note to sign in to track their progress.
When you're signed in, your progress replaces only the Available badge, so you can still see which labs are simulations.

2026-10-01/90b2bd1

The Lab page puts your next lab first

The Lab page now opens with your next lab. Signed-in learners see a card for the first available lab they haven't finished, with a link to the lesson it practices.
Each track is a section you can open and close, with a progress bar. Inside it, each lab sits directly under the lesson it practices, and planned labs take up a single line.
Tracks where you've completed every available lab move to a Completed group at the bottom, so what you're working on stays at the top.
On a return visit the page appears already arranged from your last progress instead of rearranging as it loads. Signing out clears that saved progress from your browser.

2026-10-01/8654457

The site logo stays steady between pages

The Beyond the Login name in the top-left corner no longer flickers or jumps in size each time you open a new page. Its font now loads before the page appears.

September

39 updates

September 30

2026-09-30/e2eda17

BTL Admin gets the tenant workspace, an Overview and custom roles

BTL Admin now uses the same sidebar as tenant management: Overview, a User Management group with Users and Roles, Authentication, OAuth Management, Audit and Logs. Tickets and ideas have their own Platform section. Admin links hold their place while your access loads instead of appearing late.
The new BTL Overview shows the organization at a glance: your roles, how many verified accounts there are and how many hold a platform role.
BTL accounts can now be given custom platform roles. The Roles page works like a tenant's: create a role from the platform permissions you hold yourself, then use Edit access on the Users page to assign it. BTL Admin stays a protected role that always keeps at least one holder, and every role change appears in BTL Audit and Logs.
Client secret fields in the HR Simulator and the SCIM console now ask password managers not to fill or save them.
Nested topics in the Learn sidebar step in from their parent again, and every sidebar is a little wider so long titles wrap less.

2026-09-30/c80a11e

Custom SCIM schemas, a SCIM console in Docs, and client presets

Tenants can now describe their own user attributes. The new Schemas page under User Management creates SCIM extension schemas with typed attributes, such as a badge number or a list of skills. Each attribute can be required, unique, set once, or returned only when a client asks for it. SCIM clients send and read these values, filter and sort by them, and find the schemas in the SCIM API's discovery endpoints.
User details in User Management now show each user's custom attribute values. Deleting an attribute or a schema removes its stored values, and Audit records how many were removed.
The SCIM provisioning page in Docs is now a console. Choose your tenant, create a provisioning client in one step, and send every SCIM method to your own tenant, with each request and response shown. One-step clients follow your flow policy like any other client, so allow the client credentials grant first.
New OAuth clients can start from web, single-page, native or machine-to-machine presets. Flow policy now saves each grant, response type and response mode on its own, and the client editor offers only the choices your policy allows.
Reading a schema from the SCIM API now works when the schema's URN is percent-encoded in the address.

2026-09-30/6d2bb15

OAuth grant lessons and a full-width workspace

Five new OAuth lessons cover other ways an application can get access: client credentials, device authorization, the refresh token grant, JWT and SAML assertion grants, and a guide to choosing a flow. Each has worked examples, an illustration or diagram, and a quiz.
The Lab lists three new planned labs for client credentials, refresh tokens and device authorization. They open once the pieces they need are built.
Learn, Lab, Docs, the changelog and legal pages now use the full window like the management pages, with the sidebar on the left and the page outline on the right.
Header and sidebar links now appear immediately, based on your last confirmed sign-in, instead of popping in after the page loads. The server still checks every request.
Tenant User Management now shows "(you)" beside your own BTL account's email.

2026-09-30/25a81e5

SCIM provisioning, groups and the HR Simulator

Each tenant now has a SCIM 2.0 API, so an HR system or other system of record can create, update, lock and remove users and groups as people join, move and leave.
Five built-in SCIM scopes, named after your tenant, control what a provisioning client may do, from read-only access to managing users, groups and passwords. They cannot be deleted, and a client can use one only after you assign it.
A new Provisioning page lets administrators turn the API on, choose whether it accepts passwords, how it treats people who already have an account, which roles provisioned users receive, and lower request limits. Usage and limits on the Overview page shows the SCIM budgets.
A new Groups page lets administrators organize tenant users into groups. Groups carry no management permissions, and SCIM clients change the same groups.
The HR Simulator acts as an HR system for your tenant. Connect a client, start an onboarding, lifecycle, reorganization or edge case run with fictional people, and follow each request into your tenant's Audit.
User details now show provisioning attributes. The User directory history can be searched by request or correlation ID and says which attributes changed. A new Docs page explains SCIM setup.

2026-09-30/bc73075

Tenants and the BTL organization can now choose which sign-in methods their users can use, including passkeys, authenticator apps, and email links and codes. They can also require a second step or phase in a new method with a deadline.
A new Security page lets each account manage its sign-in methods, recovery codes and trusted browsers. Tenant users get their own profile, security, registration and password reset pages on their tenant's address.
Your profile has a new Usage tab. It shows the limits your account and the tenants you created are using, and when each one resets. Tenant Overview shows the same for its tenant to administrators with permission.
Tenants now record who created each user, application, scope, signing key, token setting and role, and every tenant records the account that created it.
Support tickets let you ask BTL for help and follow the conversation. Ideas let you suggest improvements and vote on others' ideas. BTL Admins answer and review both from BTL Admin.
The Lab lets you practice what the lessons teach. The server checks each step against what actually happened on your account.
The sidebar's help links are now Learn and Docs, and the dark mode switch shows a sun or a moon.

September 29

2026-09-29/d932837

OpenID Connect, a tenant switcher and a tidier workspace

Tenants and the BTL organization can now issue ID tokens and answer UserInfo requests with OpenID Connect. They can also allow the implicit and hybrid flows when their flow policy permits them.
The new ID Token Management page controls how ID tokens are signed, how long they last, and which claims they and UserInfo return, including claims that depend on the scopes a client was granted.
Access token and ID token settings each have a default that new clients receive unless you choose another, and each can adjust standard claims within fixed protocol limits.
The header now shows which tenant you are working in. Its menu switches between your tenants, creates another named tenant when your account allows it, and replaces the tenant pickers some pages had. Tenant Admins can rename a tenant from Overview.
User Management lists tenant users and the tenant's BTL administrators in one table, with each row's actions in a menu. Applications, scopes and token settings use the same menus.
Help links, your profile and the dark mode switch now sit at the bottom of the sidebar, and short pages keep the footer at the bottom of the window.
Your profile and account activity pages now match the tenant and BTL Admin screens, and lessons no longer show sidebar notes.
The design system documentation now describes the two styles in use: reading pages for lessons and docs, and workspace pages once you sign in.

2026-09-29/06bbd60

Tenants are ready right away on new storage

We moved every tenant to new storage built to support many more tenants.
Each tenant's data now lives in its own dedicated store, created the first time the tenant is used. New tenants are ready as soon as they are created, with no separate setup step that could stall or need a retry.
New tenant addresses work immediately, without waiting for a deployment.
Tenant management, sign-in and token requests for a tenant are handled in the same place as its data, so each change and its audit record are always saved together.
Tenants created before this change start again with an empty user directory and default OAuth settings. Their addresses and owners are unchanged, and owners keep Tenant Admin access. Other administrator assignments and custom roles start over.
The profile page no longer offers a tenant setup retry, because setup can no longer stop partway.
The interface is more compact, with smaller text, controls and corners so management pages show more at once. Touch devices and sign-in pages keep larger targets.
The documentation now describes the new storage design and the release steps.

2026-09-29/a05cf4d

Token Decoder, identity and trust lessons, and cleaner branding

Every tenant, and the BTL organization, now includes a Token Decoder. Sign in as one of your tenant's users to see the token response and a decoded access token with its signature checked. You can also paste a JWT or SAML message to decode it in your browser without sending it anywhere. Administrators can rename or disable it, change its scopes and consent, and choose whether the tenant's home address opens it.
New tenants can use the authorization code flow right away. Tenants that already changed their flow settings keep them.
Access tokens can include custom claims, set as fixed text or calculated with expressions. New token settings default to signed JWTs, with a signing key created for each tenant.
Nine new Identity and trust lessons cover identity proofing, credentials and keys, and certificates and PKI, each with a short quiz.
Role editing groups permissions by area and shows how many are selected, and several tenant management screens are easier to read.
The Beyond the Login logo is sharp and consistent in both themes, and the browser tab icon has been redrawn. Sign-in pages now show the logo once, with a simpler side panel.
We documented the plan to move each tenant's data to storage that scales better.

2026-09-29/1242504

Tenant sign-in, consent, and error pages now use the same Beyond the Login sign-in design as the main site and follow your device's light or dark setting.

2026-09-29/ada047c

More reliable and secure authorization code sign-in

Tenant sign-in and consent now work in standard browsers and return users to the application that asked for access.
After the application and its return address are verified, authorization errors go back to that application with its original state and a short explanation. Every authorization response now names the tenant that issued it, which protects applications that trust more than one tenant, and discovery advertises this.
Reusing an authorization code now revokes every token issued from it, including refreshed tokens. Tokens issued to an application and tokens issued for a user can no longer share an identifier.
Flow settings now offer only the grants, responses, and response modes that work today and list the rest as not yet available. Discovery settings can no longer advertise endpoints or features the service does not provide.
Tenant Audit now records the requesting application separately from the signed-in user, and Logs keep the reason an OAuth request was rejected.
Sign-up and password recovery emails now have separate delivery allowances, and repeated requests from one network are limited, so account recovery stays available during heavy sign-up traffic.
The BTL site now keeps its OAuth sign-in state between steps. BTL organization sign-in still needs organization-local user enrollment before it can be used.

September 28

2026-09-28/74affe2

OAuth configuration and authorization code sign-in

Added organization-specific OAuth settings for tenants and BTL, including selectable grants and responses, client settings, consent choices, token rules, signing keys, and endpoint paths.
Tenant directory users can now sign in, review consent when required, and receive a single-use authorization code that can be redeemed for an access token. Tenant administrators can set user passwords and choose browser session and code lifetimes.
Client credentials can now issue access tokens. Tenant-managed token inspection and revocation use saved settings. Tenant Audit shows individual authenticated OAuth requests with client and subject IDs when known, while Logs shows request summaries.
Grant and response selections can include implicit, password, and hybrid training flows, but those runtime flows are not active yet. BTL organization interactive sign-in still needs organization-local user enrollment.

2026-09-28/aac69d0

Clearer authentication lessons and DEV tenant access

Rewrote the authentication methods and multi-factor authentication lessons with clearer examples and explanations, including password salts, and updated the guidance for writing Learn articles.
Opened DEV tenant management to verified accounts for their own tenants, subject to the existing tenant permission checks. Production access remains unchanged.

2026-09-28/156d332

Improved account page sizing

Adjusted sign-in and registration layouts to fit below the site header, with more compact spacing and responsive branding while keeping form controls usable on smaller screens.

2026-09-28/376a775

Completed DEV organization discovery setup

Connected DEV's BTL organization discovery endpoints to its authorization service so configured common scopes appear in discovery. Sign-in and token issuance through these endpoints remain in development.

September 27

2026-09-27/ce00ed3

Authentication lessons and DEV signup testing

Added seven lessons covering authentication methods, multi-factor authentication, credential recovery, and SSO, with diagrams, quizzes, and a simulated authentication-policy exercise.
Simplified signup verification for designated test accounts in DEV while preserving normal production verification.
Preserved branding concepts and illustration review materials for future site improvements.

2026-09-27/cec567f

Expanded OAuth management and learning resources

Added tenant OAuth client and scope management, including configurable redirect addresses, scope access, and tenant discovery. Tenant sign-in and token issuance remain in development.
Added matching OAuth Clients, Scopes, Audit, and Logs views for BTL administrators managing BTL's own organization.
Added custom tenant management roles and controls for existing administrators' access, with current permissions enforced throughout tenant management.
Added website documentation and contextual links to relevant Learn and Docs pages.
Added illustrations throughout the authorization code lessons and an introductory page explaining when to use the flow, with a short quiz.
Refined authentication-page alignment and dark-theme separation, and simplified the learning overview.

2026-09-27/19e6ba7

Refreshed the Beyond the Login branding

Introduced a new logo, browser icon, and graphite-and-lime colors throughout the site.
Redesigned login, registration, email verification, and password reset with a shared clean split layout that adapts to phones, tablets, and both themes.
Added Show and Hide password controls to login and registration while preserving the existing account flows.

2026-09-27/fc92439

Added a session-expiry prompt

Open account and administration pages now ask you to sign in again when your BTL session expires or you sign out in another tab.

2026-09-27/32a92d9

Prepared production services and clarified tenant history

Prepared separate production account, tenant management, and logging services with isolated databases and deployment checks.
Made tenant Audit and Logs identify the requested action and history source, including rejected and failed requests, and clarify older records with missing detail.
Clarified the OAuth authorization request quiz and PKCE pronunciation.
Recorded the existing paid hosting plan and production release procedure.

2026-09-27/5ab45b5

Compact history viewers and tenant runtime logs

Made Audit and Logs more compact, with searchable tables, filters, paging, and expandable details in one viewer.
Added tenant-scoped runtime logs alongside management, directory, and protocol history sources, with access limited by tenant permissions.
Improved service log messages and tenant attribution while keeping BTL account security history separate.
Clarified BTL administrator access-denied messages.

2026-09-27/3402d44

Fixed the development build runtime

Pinned the development site's build runtime so the TypeScript build runs with the required Node.js version.

2026-09-27/66c05a5

Added BTL Admin history views and improved site maintenance

Added separate BTL Admin Audit and Logs views with search, filters, paging, event details, and request correlation for retained BTL account and administration history.
Protected each history view with its own permission and recorded access to those records.
Made curriculum article links easier to distinguish from category headings and improved navigation and footer alignment.
Converted the site, backend, and development tools to TypeScript, with strict type checks to catch errors before deployment.
Documented tenant customization requirements for future development and reviews.

2026-09-27/3e62d45

Added a BTL Admin account directory and refreshed the interface

Added a separate BTL Admin panel for searching registered BTL accounts, filtering by platform role, viewing account details, and opening account security activity. The directory is read-only and excludes tenant-created users.
Protected account-directory access with administrator permissions and recorded access history.
Unified buttons, forms, tables, dialogs, typography, and diagrams across the site, with improved light and dark themes and layouts for different screen sizes.
Added shared design guidance and checks to keep future interface changes consistent.

2026-09-27/eaaa7bf

Improved tenant management, history, and isolation

Added user creation, editing, role assignment, locking, and deletion to the BTL Admin tenant preview. Tenant sign-in and custom role management remain in development.
Made tenant Audit and Logs searchable, with filters, paging, clearer event details, and request summaries.
Strengthened tenant capacity controls, setup recovery, database ownership checks, and separation from BTL account sessions.
Improved abuse controls for future tenant protocol endpoints, which remain inactive.
Added theme-aware expandable diagrams to OAuth lessons.

2026-09-27/d0381a5

Published authorization code lessons and completed the dev rollout

Added seven OAuth authorization code lessons with worked HTTP examples, curriculum navigation, and fourteen quiz questions.
Completed the dev backend rollout required for the BTL Admin tenant management preview.
Made complete deployment and live verification mandatory for every push.

2026-09-27/3121d08

Added a tenant management preview and OAuth learning materials

Added a BTL Admin-only tenant management preview with Overview, User Management, Roles, Audit, and Logs navigation. Overview shows tenant details and Audit shows recent tenant activity; user administration, custom roles, and service logs remain in development.
Restricted BTL account security history to authorized BTL Admins.
Added illustrations to four OAuth Foundations lessons.
Added authorization code flow lesson drafts and updated illustration authoring guidance.

2026-09-27/1e4d7a3

Added OAuth Foundations lessons

Added five OAuth Foundations lessons with short quizzes to check understanding.
Prepared diagram options for review and updated lesson authoring guidance.
Documented plans for tenant management, permissions, and activity history.

September 26

2026-09-26/1224b33

Expanded learning resources and prepared authorization services

Added illustrations to identity lessons and expanded the planned OAuth and OpenID Connect curriculum.
Added backend foundations for tenant OAuth and OpenID Connect services. These endpoints are not active yet; application authorization and token issuance remain in development.
Updated tenant activity and logging plans to distinguish existing capabilities from future work.

2026-09-26/ece4d89

Prepared support for multiple tenants

Added backend groundwork for paid subscribers and BTL Admins to own multiple tenants. Billing and additional tenant creation are not yet available through the site.

2026-09-26/158722e

Improved tenant setup and privacy controls

Improved tenant setup recovery, including administrator retries and clearer status messages.
Improved activity logs when tenant setup results are uncertain.
Improved handling of privacy choices when browser storage is unavailable.

September 25

2026-09-25/625eb63

Added account activity and tenant setup

Added account activity history and support tools.
Added administrator roles and personal tenant setup. Tenant database activation still requires configuration.
Improved account navigation while sign-in status is checked.
Updated privacy information and development review requirements.

2026-09-25/2024a24

Prevented signed-out account links from flashing while signed-in users move between pages.

2026-09-25/9f54781

Added password reset

Added password reset from the sign-in page.
Updated verification emails to better accommodate delayed delivery.
Added Git commit references to changelog dates.
Cleaned up earlier changelog wording.

2026-09-25/cc97ba6

Improved email diagnostics

Added diagnostics to help investigate account email delivery issues.

2026-09-25/4a8938d

Updated email rate limits

Updated email rate limits.

2026-09-25/fdfe626

Registration password rules and service setup

Changed new-account passwords to require at least 8 characters and three of four groups: uppercase letters, lowercase letters, numbers, and symbols.
Removed the explanatory text below the password field.
Added the missing development account service, database setup, and site connection. Live email delivery still needs verification.

2026-09-25/cb37e38

Account groundwork and expanded curriculum navigation

Implemented initial registration, email/password sign-in, and a profile page showing name, email, and country. Public account access awaits deployment and live email verification.
Added email integration with a verification code and magic link that expire after ten minutes. Using either invalidates both, and the waiting registration page completes sign-in automatically.
Added compromised-password screening and verification recovery after a page refresh or interrupted connection.
Updated privacy and cookie information to explain account data and verification.
Expanded curriculum navigation with planned topics, including detailed OAuth and OpenID Connect sections.
Added focused account tests and required independent review before every push.
Made registration limits and failed-code handling consistent for new and existing accounts. Existing accounts receive a sign-in notice, and registration attempts leave their details and access unchanged.

2026-09-25/c668bec

Added Privacy, Cookie, and Terms pages explaining how the educational service works and handles information.
Added Allow All and Only Necessary choices, with cookie settings available in the footer. Optional analytics loads only with permission on the public website.
Moved About and Changelog to the footer alongside the policy pages.
Updated the site tagline, removed the Early days label, and added a Beta badge.

September 24

2026-09-24/566abc7

Building the foundation

Created Beyond the Login's learning website, with an overview, an introduction to the founders, and support for mobile screens and light and dark themes.
Added nine Identity Fundamentals lessons and a History of SSO article.
Added short quizzes with unlimited retries and progress saved in the learner's browser.
Added search metadata, a sitemap, and a security reporting contact.
Simplified navigation to show available lessons, removed the Reference page, and added this dated changelog.
Added a version number and Git commit identifier to page footers to make reported issues easier to trace.
Established separate development and production release workflows, and connected the initial development databases. Accounts and live identity labs are still being built.

Changelog

2026

October

October 29

Typing no longer jumps the page in Dia

Sign-in pages stay put

What this production release includes

Staff sign-up fix tightened

Every lesson and lab rewritten in the guided format

The sign-in padlock stays up longer

October 28

More from today's update, and a corrected padlock fact

Clearer pages across the site, and a playful sign-in padlock

Foundations lessons and labs rewritten, with optional Challenges

October 27

Four more validated Identity Foundations lessons for production

SAML metadata opens in your browser

Password eye button fixes

An eye button for passwords, and a steadier Lab page

October 26

Sign-in remembers your email, and clearer lesson figures

Clearer working rules for our AI assistants

The padlock's dizzy swirl follows your circling

October 25

Simpler sign-in, a clearer lesson on limited access, and Capture the Flag in the Lab

A simpler Learn overview, and progress grouped like Learn

October 24

Four more validated Identity Foundations lessons for production

Lab Quizzes and today's fixes reach the site

Practice what you've learned with Lab Quizzes

Clients, servers and addresses shows how to find a registrable domain

Capture the Flag challenges open where you're working

Capture the Flag joins Specialist topics in the Lab

Identity fundamentals explain every idea before using it

The padlock talks, gives hints and dreams

Request consoles inside each lab task, and steadier lesson pages

Cookie Policy: one motion choice across the site

October 23

Training paths, one path at a time

Capture the Flag, rebuilt on the Lab design

A calmer Lab toolkit page

Lab 5 now checks the address before you sign in

The padlock on tenant sign-in, and a steadier lab task list

A new logo, and a padlock that learns with you

A friendlier front page, and a padlock on every error

Easier lab sign-in details and a clearer Lab catalogue

October 22

See when BTL users last signed in

A steadier lab task list

Meet the padlock

Clearer Identity Foundations labs and four new CTF challenges

Rippling workspace cards

Smoother motion and a cleaner layout

Tidier lesson section list and a lighter sign-in background

October 21

Clearer lab controls and browser guidance

Find your current lab

Keep sign-in usable during site updates

Four validated Identity Foundations lessons for production

Clearer session settings and more reliable lab progress

Scrolling Identity Foundations lessons and clearer figures

Lab reset, clearer progress and steadier reading

Clearer lab setup, sign-in returns and keyboard focus

October 20

Fuller Identity Foundations lessons and simpler lab setup

Story-led Identity Foundations lessons

Guided foundations and clearer sign-in pages

Sign-in that fits your screen, clearer lab progress and steadier account flows

Cleaner lab setup and simpler administration

Centred sign-in, a site map footer and smoother account flows

October 19

Reliable progress and smoother page interactions

Clearer tenant workspaces and Discord community updates

A private lab inbox and clearer navigation

A reviewed and rebuilt curriculum

Inviting staff to Beyond the Login

Fixes from testing the site the way visitors use it

Lab progress checks without limits getting in the way

A lab page that follows your work

Wider lesson text, a simpler Learn menu and new Discord roles