Skip to main content

August 2026

· 5 min read

The August 2026 releases introduce QR Studio for instance-configurable QR code colours and centre logos, bring the API Explorer into Composer so it is available in production, consolidate the OIDC issuer onto the API host, and deliver identity linking and merging so a single identity can span multiple identity-store accounts. Branded QR codes now also apply to issuance, draft credential definitions are clearly marked in Composer, and Concierge greets users by their full display name.

v2026.8.2​

🚀 What's new​

New features​

  • Identity linking and merging - An identity is now a person record that can be linked to one or more identity-store accounts, with one link marked as primary. From the redesigned identity details page in Composer you can link and unlink identity stores, set the primary account, and merge duplicate identities into a single canonical identity. A merged identity's credentials, presentations, wallets and passkeys are shown consolidated on the canonical identity, with "Held by" and "Presented by" columns indicating which linked identity each record belongs to. Revoking all credentials on a canonical identity revokes across the whole merged family, and the confirmation dialog states this. Merges can be undone. In Concierge, a user whose identity has merged identities sees their consolidated credentials and can request a Microsoft Entra Temporary Access Pass for each eligible linked account. To reflect this model, "Issuee" and "Issuee store" are now labelled "Identity" and "Identity store" throughout Composer, and the identity guide in the documentation has been rewritten as "Identity linking".

Enhancements​

  • Branded QR codes for issuance - The QR code styling configured in QR Studio now applies to issuance requests as well as presentation and photo-capture requests, so an in-person issuance shows a consistently branded code from photo capture through to the final credential offer. This covers Composer in-person issuance, Concierge issuance and remote issuance. Integrations that request no QR code are unaffected.
  • Draft credential definitions are clearly marked - A credential definition that has not yet been published now shows a draft banner in Composer explaining that issuance controls and the manifest URL become available once it is published from the Publish tab. The issue and bulk-issue actions are hidden while the definition is in draft, and the manifest URL shows a pending indicator until publication.
  • Simplified issuance instructions - The unused Title field has been removed from the credential card issuance instructions section when creating or editing a credential definition. Only the Instructions text was ever shown to the holder, so authors no longer need to enter a duplicate value. Existing definitions keep any title they already hold.
  • Remote issuance error documentation - The remote issuance guide now documents the error responses returned when creating remote issuance requests, separating per-request validation errors from whole-call errors, explaining that batch validation is atomic, and providing worked examples and reference tables for each.

⚠️ Breaking changes​

  • GraphQL schema: The Identity fields issuer, issuerLabel, identifier and identityStoreId are deprecated in favour of the new identityStoreLinks and primaryIdentityStoreLink fields, which expose every linked account rather than a single one. The deprecated fields remain available for now; update integrations to the new fields ahead of their eventual removal. New optional includeMerged arguments on identity-scoped queries let integrations opt into consolidated results for merged identities.

🛠️ Notable fixes​

  • Fixed "Open in API Explorer" and the "Try it" buttons on the issuance and presentation builders so the selected operation reliably opens in the API Explorer as a new editor tab, rather than showing an empty editor or a previously opened operation.
  • Fixed the OpenID Connect section breadcrumb in Composer, which still showed the old "Authentication" label.

v2026.8.1​

🚀 What's new​

Enhancements​

  • API Explorer loading guidance - When the embedded API Explorer cannot start, typically because browser tracking protection or a privacy extension blocks it (most often Firefox with Strict tracking protection), Composer now shows a warning after 15 seconds explaining the likely causes instead of an indefinite loading state. A new troubleshooting section in the Apollo Studio guide walks through the fix.
  • Full-name greeting in Concierge - Concierge now greets signed-in users by their full display name as stored in your identity store, rather than guessing a first name from it. This avoids awkward greetings for display-name formats such as "Surname, First".

🛠️ Notable fixes​

  • Fixed an error that could prevent the credential details page in Composer from loading, seen when viewing a credential whose identity verification had failed.
  • Fixed the identity store view in Composer falsely reporting "connection failure" for User lookup and External authentication method (MFA), with Connectivity showing "Needs attention", when the signed-in user had issuer or credential administrator permissions but not the Instance Admin role.

v2026.8.0​

🚀 What's new​

New features​

  • QR Studio - A new Branding → QR code section in Composer lets you style the QR codes your holders scan. Choose the foreground and background colours, upload your own centre logo, and preview the result before saving. Colour pairs that fall below a 4.5:1 contrast ratio are rejected at save time, and an uploaded logo must decode as a PNG image, so a malformed file is caught on upload rather than when a code is generated. These checks rule out the most common causes of an unreadable code, but they are not a guarantee of scanner compatibility — preview your style and scan-test it before rolling it out.

Enhancements​

  • API Explorer now available in Composer - The API Explorer is now built directly into Composer and available in production, not just in non-production environments. Administrators with the appropriate role can explore the GraphQL schema and run queries against their own instance without leaving Composer.
  • Consolidated OIDC issuer addressing - The OIDC issuer is now served from your instance's API host rather than a separate subdomain, so your API and OIDC endpoints share a single host. When you switch to the updated API addressing in Composer, both move together, and the issuer published at your discovery endpoint remains authoritative.