Two-step sign-in, phone and wallet sign-in, and a sign-in page in eight languages
Sign-in grows from a few methods to most of what people expect: two-step sign-in, email and phone codes, Apple and a provider of your own, usernames, wallets, guests and device codes, with bot protection and sign-up rules in front of them. The hosted sign-in page speaks eight languages and carries each app's own name, logo and words. Feature flags targeted at tags or set to allow everyone now turn on in the SDK, a short outage at a webhook endpoint no longer switches it off, and a workflow's delayed steps keep their timing.
Added
13- AuthenticationTwo-step sign-in. People add an authenticator app such as Google Authenticator or 1Password, get ten single-use backup codes, and are asked for a 6-digit code after their first step. Set the policy to Off, Optional or Required under Authentication > Security. A device the person chooses to trust skips the code for up to 90 days unless you change the window, a passkey that checked a fingerprint or PIN counts as both steps, and an admin can reset someone's second step from their page in the console. You can also allow a code by text message, through your own SMS provider, beside the app and never instead of it.
- AuthenticationEmail and password works end to end on the hosted page: one form with Forgot password?, a 6-digit reset code, and a reset that also lifts the sign-in lockout. Passwords found in a known breach are refused on sign-up, reset and change, checked against Pwned Passwords with only the first five characters of the password's hash leaving the server.
- AuthenticationEmail sign-in codes. A Magic Link method can send a 6-digit code, a link or both, and a code can create the account too, with the address already verified. A code is the better choice when people read their mail on a phone and sign in on a laptop.
- AuthenticationPhone sign-in. People sign in or sign up with a 6-digit code by text message, WhatsApp or voice call, sent through your own Twilio account or a signed webhook of yours, so your provider bills you and BuildBase never does. The SMS tab sets a daily cap with an early warning, sends a test, and keeps a 30-day delivery log without the full number or the code.
- AuthenticationSign in with Apple and one OpenID Connect or OAuth 2.0 provider of your own, such as Keycloak, beside Google, GitHub, LinkedIn and Microsoft. Google One Tap offers a one-click sign-in to people already signed in to Google. A returning social sign-in now finds its account by the provider's own user ID before the email, so someone who changes their address still reaches the same account.
- AuthenticationFour more ways in, each off until you add it: usernames beside the email for password sign-in, Ethereum and Solana wallet sign-in by signed message, Continue as guest with an account that keeps its data when the person adds an email, and device code sign-in (RFC 8628) for a CLI or a TV.
- AuthenticationBot protection with Cloudflare Turnstile on sign-ups, emailed and texted codes and guests, and on password sign-ins too: every one, or only once an address has failed three times in 15 minutes. On the BuildBase sign-in domain it needs no keys; a custom domain takes your own. A separate switch refuses disposable email addresses at sign-up.
- AuthenticationWho can sign up: an allowlist and a blocklist of addresses and domains, and a waitlist mode where only the entries you approve on Beta users can create an account. The lists stay private, and a refused address hears the same sentence whichever list refused it.
- UsersImport users from Clerk, Auth0, Firebase or Supabase with npx buildbase import, or any other system through POST /api/users/import. Each user keeps their email, verified status, name, old id, phone, social sign-ins and password hash, and signs in with the same password, which is moved to bcrypt at that first sign-in.
- UsersSign in as a user from their page in the console, to see the app as they do: read-only unless an owner turns that off, for 5 to 60 minutes, with the start written to the security audit log. Custom claims, set per user from the console or the API, reach your backend at sign-in and in every agent token.
- AuthenticationThe routes behind account self-service, for your own screens: change an email with a code, change a password, connect and remove social sign-ins and wallets without removing someone's last way in, add a phone, delete the account after a grace period you set, and Confirm it's you, which re-checks a sign-in older than 10 minutes on the hosted page without signing anyone out.
- Sign-in pageThe hosted sign-in page in eight languages, with a language switcher, and each app's own name, logo, dark logo, favicon and brand colour. Layouts include a split screen and pattern backgrounds, fonts include twelve from Google Fonts or your own file, and every sentence you can write is in one editor, per app and per language, with nothing machine translated. Sign-in emails name the app and can show its logo.
- WebhooksSixteen new events, 128 in all: user.mfa_enrolled, user.mfa_disabled, user.mfa_reset_by_admin, user.email_changed, user.imported, user.account_linked, user.account_unlinked, user.phone_added, user.phone_verified, user.phone_removed, user.deletion_scheduled, user.deletion_cancelled, user.deleted, auth.login_failed, auth.signup_challenged and auth.sms_budget_exceeded.
Improved
2- ConsoleEvery Authentication screen explains itself: a ? beside each setting opens a short note in plain words, each method says where to get its provider's keys, and changes that would lock people out ask first and say what they do.
- AuthenticationA refused sign-in carries a reason a page can translate: invalid_credentials for a wrong password or an unknown address alike, locked during the 15-minute lockout, which a password reset now lifts, and blocked, said only after the right password so an address alone reveals nothing.
Fixed
23- AuthenticationA password containing <, > or & is hashed exactly as typed. The request sanitiser used to change those characters first; a password stored that way still signs in and is re-hashed as typed at that sign-in.
- AuthenticationA magic link opened in a browser that did not ask for it, such as a phone's mail app, now says to open it where it was asked for and stays usable there, instead of being spent.
- ConsoleCustom sign-in domains are no longer all marked as insecure on the Domains tab, and link over https.
- Feature flagsA user feature flag targeted at user tags now turns on for users with those tags, and "Allow all users" turns it on for everyone. Both settings were saved in the console, but what the SDK read ignored them. A workspace flag set to "Allowed to all" is now on for every workspace, as the console's "Enabled for all users" badge already said, including workspaces whose plan leaves it off. An archived user flag now turns off for everyone it still targeted.
- WorkflowsA workflow's later steps no longer run before their delay is up. A recovery sweep could start every remaining step of a running drip about 40 minutes in, including both branches of a wait-for-an-event and the steps after a failed one. Recovery now resumes only the step a run has reached, with the rest of its delay.
- WorkflowsA step that fails by throwing, such as an HTTP request that times out or cannot connect, is now retried under its node's retry policy. When its last attempt fails, the step's error path runs or, without one, the run fails, sends workflow.instance_failed and frees its place in the concurrency limit. Before, the first failure ended the step with no retry and left the run marked running. An HTTP step that gets an answer, whatever its status, still completes with success set to whether it was 2xx.
- WebhooksA webhook endpoint is now switched off after 50 failed deliveries in a row, each one counted only after all its retries, instead of after 50 failed attempts, so a two-minute outage at your end no longer turns it off. Every event an endpoint we switched off does not send now appears in its delivery log as Skipped, and the organization's owner and admins are emailed when we switch one off.
- DocumentationThe webhooks documentation now describes delivery as best effort: five attempts over about two and a half minutes, one signature timestamp per event, no resend, and the cases in which an event is lost. It used to promise at-least-once delivery.
- SecuritySomeone removed from an organization can no longer get back into its billing workspace with a sign-in from before their removal. Central's internal API now checks a request's signature against the bytes that were sent, so a webhook endpoint name made only of digits no longer gets its disable notice refused.
- PlatformA full Redis no longer makes every API request fail: rate limits let requests through while their store cannot be written, and a member's permission check no longer fails when its cache cannot be updated.
- Self-hostingSelf-hosted Redis now starts again after a restart; before, a reboot left the server without it. The images move off Alpine 3.21, which reaches end of life on 1 November, and the database restore script now restores the backup it is given and asks before it overwrites anything.
- WorkflowsA step that is retried no longer sends its email or push a second time. An HTTP step's POST, PUT, PATCH or DELETE carries an Idempotency-Key header, the same on every retry of that step in that run, so your endpoint can ignore a repeat; a key you set in the step's headers is sent instead.
- WorkflowsResuming after the emergency stop turns back on only the workflows the stop paused, and a workflow you paused yourself stays paused. The stop and the resume now appear in each workflow's audit log. Deleting a workflow cancels its runs that are still going, and a paused run keeps its wait for an event so it can still be woken when it resumes.
- WebhooksEvery webhook event carries an id, in the body and the x-buildbase-event-id header, the same on every retry, so a receiver can skip one it has already handled. The delivery Logs sheet now pages through older attempts and offers Try again when they cannot be loaded.
- BillingA Stripe checkout delivered twice no longer resets the period's plan credits. The plan screen offers Manage billing when a payment needs attention, and says so with Try again when billing cannot be opened, instead of waiting for ever.
- SecurityActivity rows, attribute history, email opens and link clicks keep only a short list of request headers, such as the browser and language, and never a session id, token or cookie; a migration cleans the rows already stored. Live workflow updates in the console reach only members whose role can read workflow runs.
- PlatformEvery API response carries an X-Request-Id, and a console error caused by our side shows it as a Reference to quote to support. Browsers keep the API's CORS check for two hours instead of five seconds, which saves a round trip on most requests. An id or code made only of digits, or one starting with 0 or +, now reaches the API exactly as sent instead of being turned into a number.
- PlatformQueued emails no longer keep a copy of their content in the job queue, failed background jobs are kept up to a fixed number, and very large API answers are no longer cached, so one busy organization cannot fill the shared queue store.
- DocumentationThe Next.js quickstart works as written: it leads with npx buildbase init, and shows every file to create by hand, the client provider, the sign-in routes and the callback page included.
- PlatformIf Redis stops, the API keeps answering instead of hanging. A request that needs a cached value reads it from the database after at most two seconds, and at once after Redis has been gone that long; the health check reports degraded straight away.
- WebhooksA webhook retry now sends exactly the body and signature of the first attempt, instead of looking up the person or workspace it names again, so one event id never arrives with two different bodies.
- AuthenticationA custom sign-in domain is marked verified only once it can serve sign-in: Vercel has confirmed you own it, its DNS points at Vercel and the sign-in page answers over HTTPS. Until then sign-in stays on the BuildBase domain, and the Domains tab says which check is failing. A verified domain that stops serving goes back to the BuildBase domain after about an hour of failed checks.
- Sign-in pageOpened inside the built-in browser of Instagram, Facebook, TikTok, LinkedIn, X or another app, the hosted sign-in page says how to open it in the phone's own browser, with a link to copy that keeps the sign-in going (and an Open in browser button on Android), and hides Google sign-in and passkeys, which those browsers refuse.