20 August 2026 (v2.164)

Staging 🧪

ReachFive v2.164 brings a few new features and updates:

As always, we fixed a few items for you.


Pass state parameter on logout endpoint

You can now pass a state query parameter on the /identity/v1/logout endpoint.

ReachFive returns this value as-is in the query string of the post-logout redirect URL (redirect_to, post_logout_redirect_uri, or the Referer header).

This lets you encode the original page (typically as Base64) so you only need to whitelist one logout callback URL in the ReachFive Console. Your application then decodes state on that page and redirects the user to their original location.

The Core SDK logout method also accepts this optional state parameter.

For more details, see /identity/v1/logout and logout.


Passkey changes in updated_keys

What’s new: when a passkey is added to or removed from an existing profile, the accompanying user_updated event now lists webauthn_credentials in updated_keys.

What’s unchanged: ReachFive still emits webauthn_credential_created and webauthn_credential_deleted for the passkey lifecycle. Those events fire alongside user_updated.

The following situations show which events fire and what updated_keys contains:

Add a passkey

Events: webauthn_credential_created and user_updated. auth_types does not gain a WebAuthn value until the user later authenticates with the passkey.

{
  "type": "user_updated",
  "updated_keys": [
    "webauthn_credentials"
  ]
}

Delete a passkey

Events: webauthn_credential_deleted and user_updated.

{
  "type": "user_updated",
  "updated_keys": [
    "webauthn_credentials"
  ]
}

If this was the user’s last passkey and they had already logged in with WebAuthn, auth_types is included as well:

{
  "type": "user_updated",
  "updated_keys": [
    "webauthn_credentials",
    "auth_types"
  ]
}

Sign up with passkey

The sign up flow is unchanged.

  • Events: signup and webauthn_credential_created.

There is no user_updated event.

Authenticate with passkey

The passkey’s last-used timestamp is updated, but that change is not listed in updated_keys.

A completed WebAuthn login adds a WebAuthn value to auth_types.

That change is reported on the login event, not on user_updated.

For more details, see updated_keys and Passkeys: User events.


Fixes

Item Fixed

In some limited instances, custom fields weren’t displaying properly for some user profiles.

✓

For some customers using Outlook and similar email clients, the signup invitation wasn’t working properly. Users were being denied access unexpectedly.

✓

ReachFive Console

There was a display issue on the ReachFive Console when viewing some client details.

✓
R5 AI Assistant
The R5 AI assistant can make mistakes, verify answers.

Confirm Deletion