Changelog

Releases

1. 3 November 2026LoginLlama API and dashboard

   Stricter scoring for admin accounts

   • Send privileged: true for an admin account. A new network, country and device then scores 7 rather than 5, and three failed attempts flag the account rather than ten. Comes back as the privileged_account reason code.
   • Optional fields sent as null are treated as absent. The Python and PHP SDKs send unset fields that way, and the API used to reject those calls with a 400.
   • Team owners can require two-factor authentication for every member.
   • The dashboard asks for the second factor after a magic link or GitHub sign-in too.
   • API keys and the webhook secret are shown to owners and admins only.
   • Checks made with a test key are free.
2. 3 November 2026Python SDK3.1.0

   Fails open

   • If LoginLlama cannot be reached, the check returns a pass instead of raising, so an outage never blocks your sign-ins.
3. 3 November 2026PHP SDK1.3.0

   Fails open

   • If LoginLlama cannot be reached, the check returns a pass instead of throwing, so an outage never blocks your sign-ins.
4. 3 November 2026Clerk integration1.0.0

   First release

   • Checks every Clerk sign-in against LoginLlama.
5. 3 November 2026Auth.js integration1.0.0

   First release

   • Checks every Auth.js sign-in against LoginLlama.
6. 2 November 2026LoginLlama API and dashboard

   Test mode, a new dashboard and fewer false alarms

   • Test mode, as in Stripe: staging keys get their own data, and their logins never mix with live ones.
   • A redesigned dashboard.
   • Repeated failed passwords on one account, or one IP failing across many accounts, now raise the score (after_failure_burst, ip_password_spraying).
   • The score looks at the network a login came from, not only the exact address, so a phone changing IP on the same carrier no longer looks new.
   • Impossible travel no longer fires when a mobile gateway jumps between cities in one country.
   • At most one alert email per user, network and device a day.
   • Resetting a password ends every other session.
7. 29 October 2026LoginLlama API and dashboard

   Better locations and a new alert email

   • A redesigned "Was this you?" email, with a map that loads.
   • Starlink addresses are placed with Starlink’s own location feed rather than the ground station.
   • IPs the location database cannot place get no coordinates, instead of a point in the middle of a country.
   • Failed attempts no longer count as logins in a user’s history.
   • Twelve fixes to the login check endpoint.
8. 29 October 2026Node.js SDK3.1.0

   Fails open

   • If LoginLlama cannot be reached within two seconds, the check returns a pass instead of throwing.
   • Reads the IP address and user agent from a Fetch API Request, as well as from Express and Node requests.
9. 28 October 2026Better Auth plugin1.0.0

   First release

   • Checks every Better Auth sign-in against LoginLlama.
10. 19 October 2026Node.js SDK3.0.0

    Node.js 24 or later

    • Breaking: drops Node.js 22. Upgrade to Node.js 24 before installing.
    • Patches a critical handlebars advisory and 19 alerts in the development toolchain.
11. 19 October 2026PHP SDK1.2.1

    Dependency update

    • Raises PHPUnit to 10.5.66 for a security advisory. No change to the library itself.