Kinde October product updates

The offboarding problem Someone leaves one of your customers on a Friday. IT removes them from Okta before lunch. Then nothing happens in your product, because nobody told it, and that account keeps its permissions until someone remembers to file a ticket. That’s not a people problem, it’s a plumbing problem, and this month we fixed most of it. Along the way we shipped a long list of changes that put more control in your hands (and your customers’) instead of ours. SCIM directory sync, now for everyone Back in April we asked for beta testers. Now it’s live for every Kinde business: when your customer adds, updates, suspends or removes someone in Entra ID, Okta or any other SCIM-compatible provider, Kinde updates that user for you. Joiners get access, leavers lose it, and nobody has to remember anything. Find the new Provisioning menu in each organization, with Directory and Logs pages showing exactly what came through. Each change fires a user.updated webhook with the source scim, and a SCIM DELETE suspends rather than deletes, so returning users reattach to the same Kinde account. Plan versions you can actually see Every time you publish a billing plan, Kinde saves it as a new version, and existing subscribers stay on theirs. Now you can see every version with its subscriber count, pricing and publish date, roll back with Save as draft, and see which pricing tables a publish will affect, so draft edits never reach your customers. Cancel at the end of the billing period Plans have a new Cancellation takes effect setting, so cancellations can apply immediately or at the end of the billing period. Customers keep access until then and can hit Keep plan in the self-serve portal if they change their mind. Existing plans still cancel immediately unless you change the setting. Roles that belong to one organization (Scale plans) Until now, roles were business-wide. A “billing approver” role created for one customer was visible and assignable in every organization. On Scale, each organization can now define its own roles and permissions, up to 100 per org, managed from the org’s Roles tab, the Management API or the self-serve portal. Invalid role keys now return INVALID_ROLES instead of quietly disappearing. Let users approve AI agents (available on request) In July we gave your APIs a bouncer. Now your users get a say on who’s on the guest list: turn on Ask users to approve agents and they’ll see a consent screen before Claude, ChatGPT or Cursor gets access. Approvals last 30 days, users and admins can revoke them any time, and you can contact support to have it enabled. Safer email trust for social and SSO connections The “Trust email addresses” on/off switch is now three options: Don’t trust, Verify, then trust (merge only after a one-time code confirms the email), and Trust. That middle option means you can keep automatic account linking without the account-takeover risk of trusting a provider that doesn’t verify emails. The new trust_mode option is in the Management API, and is_trusted is now deprecated. Find out before your customers do An expired Entra ID client secret. A SAML signing certificate about to lapse. An SMTP server rejecting sends after someone changed a password. These are the kinds of things you usually hear about from an annoyed customer. Kinde now shows a banner on your dashboard and status page when an enterprise SSO connection or custom email sender breaks, including SAML certificates expiring within 30 days. The alerts clear automatically once it’s fixed. Other 🔥 updates in October One free trial per customer: Self-serve portal customers can only start one trial, while admin plan assignments aren’t restricted. POST /api/v1/billing/agreements gets a new optional skip_trial flag. Change plans mid sign-up: A new “Select other plan” link on the payment page lets users go back and pick something different. Clearer payment errors: Payment-step failures now show specific codes and messages, t