What's New - Verified 4.9.2 Release

Version 4.9.2

Released to UAT: October 7th 2026

Released to Production: October 14th 2026

Release Type: Maintenance Release

Highlights

Create Privacy Keys from a facial image: the Admin API can now mint a Privacy Key server-side from a supplied image. The tenant's duplicate-search policy is applied.
Optional IP geolocation lookup: the third-party IP geolocation lookup can be disabled on demand.
Updated fallback capture: fallback selfie capture (used by older browsers) now uses the same face detection model as standard in-browser capture.
More complete Privacy Key authentication audit trail records: rejected Privacy Key transactions now include location (if enabled), injection attack detection and liveness details, plus additional technical information.
Windows Web Sign-in support: selfie capture now works in Windows Web Sign-in and other apps built on the legacy Microsoft Edge engine, extending authID's out-of-the-box Microsoft Entra ID integration.
Handoff method selection: administrators can offer link-only or email-only handoff.

Configurable IP geolocation lookup: the IP geolocation lookup can now be disabled, so end-user IP addresses are not sent to the external geolocation provider. Transactions complete normally; the Identity Portal location panel shows device information without a derived location. The lookup stays enabled by default; no change for existing deployments.
Fallback selfie capture face detection model: when a browser cannot run the standard capture engine (for example, WebAssembly disabled by device policy, or iOS below 15), selfie capture now uses the same face detection model as standard in-browser capture.

Privacy Key audit trail details: for every Verified with Privacy Key transaction, the transaction confirmation now includes device metadata, location (if enabled), injection attack detection details and the PAD result, all available through the Customer-facing API. Previously this information was available only on request through Customer Support.

Add Privacy Key from a facial image: POST accounts/{accountNumber}/fido2Credentials now accepts a facial image. The Privacy Key is generated server-side and returned in the response, and the tenant's search policy is applied: with duplicate blocking enabled, an image that matches a different account is rejected and no credential is created.
Introduction text on v2 operations: POST /v2/operations now accepts introduction text for document (Proof) and biometry requests and includes it in the notification sent to the user, matching the v1 API. Requests without it behave as before.

Selfie capture in Windows Web Sign-in: selfie capture now works in Windows Web Sign-in and other Windows apps that embed the legacy Microsoft Edge engine (EdgeHTML, Edge 18).
Handoff method selection update: the skipHandoffOptions setting now accepts link, email or qrcode to show only that handoff method. Existing configurations are unchanged.

Identity Deduplication performance: the case list now loads one page at a time, and Account ID search is an exact match on account number or UIN, so both remain fast regardless of case history size.

Security updates: platform components were updated to resolve high and critical security advisories, and container images were hardened to remove unneeded system libraries.

Workflow Progress image visibility: selfie images in Workflow Progress now consistently follow the Transaction Result Auditor role.
Decision Engine after switching tenants: the Decision Engine page now loads the correct policy after switching to a child tenant in Identity Portal.
Face mask in fallback capture mode: the face mask overlay no longer attempts to load when the fallback capture mode is in use.

For technical integration details or questions about this release, please contact your authID representative or [email protected].