release-2026-02-17: Improve post message reliability

This is Internet Identity release release-2026-02-17 for commit c14480a6691be839c622a45e8b9f36270e56faa5.
The sha256 of production asset internet_identity_production.wasm.gz is d29b6a07171dbd4f620e181e0117a744f1c87d5b0a75c0d1250de415d1fa3d37.

This release improves the reliability of the PostMessage communication protocol between applications and Internet Identity.

What's Changed

• Manually close transport channel in test app by @sea-snake in #3622
• Update Passkey AAGUID data by @pr-automation-bot-public[bot] in #3614
• Add e2e test for OpenID attributes by @sea-snake in #3623
• Increase postmessage timeout by @sea-snake in #3624

Full Changelog: release-2026-02-16...release-2026-02-17

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	d29b6a07171dbd4f620e181e0117a744f1c87d5b0a75c0d1250de415d1fa3d37
internet_identity_dev.wasm.gz	db10c84daeee7a539695a55e4cf1176207ffe22eec9df8a635cdcb7c4f917771
internet_identity_test.wasm.gz	6d90197efaf5ea8357ffd3a96f46ed06e18ecc1e7db8ca3b0eff09cbdcc7d772
archive.wasm.gz	c6ea52685f06d61994208b540272cf71d44a4d2be5396665ce8001983877f16c
vc_demo_issuer.wasm.gz	1b72e24d22c778f99a0296c0b0077da2ea887b1504f4a34cabeda05fe331f6ed

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout c14480a6691be839c622a45e8b9f36270e56faa5
./scripts/verify-hash --ii-hash d29b6a07171dbd4f620e181e0117a744f1c87d5b0a75c0d1250de415d1fa3d37

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.

release-2026-02-16: Fix ICRC-29 heartbeat in Safari

This is Internet Identity release release-2026-02-16 for commit dba38d112a74d88c42faba7720e00d3a4a772992.
The sha256 of production asset internet_identity_production.wasm.gz is f99ceba32fb61f94123f9c18e7115e485c15dfa2194c5d7110b01a3e10de8656.

This release fixes an issue related to ICRC-29 heartbeat not always working correctly in Safari due to energy saving logic specific to that web browser. Additionally, it includes a minor fix for Caffeine logo.

What's Changed

• Fix dark dapp logo in direct OpenID flow by @sea-snake in #3621
• Fix ICRC-29 heartbeat in Safari by @sea-snake in #3620

Full Changelog: release-2026-02-13...release-2026-02-16

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	f99ceba32fb61f94123f9c18e7115e485c15dfa2194c5d7110b01a3e10de8656
internet_identity_dev.wasm.gz	a8990111749cb27b9691c07f946f143a8533845f18c9a642c8db0631f6d76403
internet_identity_test.wasm.gz	d04278e305326261574b45cb70e4133343a4206e78773f933e32a61664e012d7
archive.wasm.gz	c6ea52685f06d61994208b540272cf71d44a4d2be5396665ce8001983877f16c
vc_demo_issuer.wasm.gz	1b72e24d22c778f99a0296c0b0077da2ea887b1504f4a34cabeda05fe331f6ed

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout dba38d112a74d88c42faba7720e00d3a4a772992
./scripts/verify-hash --ii-hash f99ceba32fb61f94123f9c18e7115e485c15dfa2194c5d7110b01a3e10de8656

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.

release-2026-02-13: Show upgrade banner for legacy domains

This is Internet Identity release release-2026-02-13 for commit 8973fd482899748e4f0ca5b557159fc5f7440b98.
The sha256 of production asset internet_identity_production.wasm.gz is 76f9d70cdd3e6c9e58511e53952946d2e6af04441ac59321aa65726b190022b2.

This release fixes the upgrade banner for legacy domains, making sure it's shown when dapps are integrating with a legacy domain. Additionally e2e tests have been added to cover the legacy domains, a new Plausible funnel was added for the direct OpenID authentication flow and the page view logic has been fixed to get a more accurate bounce rate.

What's Changed

• Add e2e tests for legacy domain redirects and enable upgrade banner for legacy domains by @sea-snake in #3617
• Add direct OpenID funnel by @aterga in #3618
• Fix bounce rate from redirect and callback flows by @sea-snake in #3619

Full Changelog: release-2026-02-10...release-2026-02-13

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	76f9d70cdd3e6c9e58511e53952946d2e6af04441ac59321aa65726b190022b2
internet_identity_dev.wasm.gz	c777435f0537b0ef094a109f2508bc2669f7bf9860785df08eed3a900f424be1
internet_identity_test.wasm.gz	6578a4535a8444bdb0e1bbd3beeacf07bc2be58ec82f8e57dcfc70bd681145e7
archive.wasm.gz	c6ea52685f06d61994208b540272cf71d44a4d2be5396665ce8001983877f16c
vc_demo_issuer.wasm.gz	1b72e24d22c778f99a0296c0b0077da2ea887b1504f4a34cabeda05fe331f6ed

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout 8973fd482899748e4f0ca5b557159fc5f7440b98
./scripts/verify-hash --ii-hash 76f9d70cdd3e6c9e58511e53952946d2e6af04441ac59321aa65726b190022b2

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.

release-2026-02-10: Certified OpenID attributes (pilot feature)

This is Internet Identity release release-2026-02-10 for commit e1369f5b896540ed47b6e841ae9ac40c3a968716.
The sha256 of production asset internet_identity_production.wasm.gz is e32532501b36e1a8cc850e3d6cfbe64627b137c6023351be7759fbf33493a31b.

This release prepares id.ai for handing certified OpenID attributes. Since the design around this feature may still evolve in the coming weeks, this release enables it as a pilot and only for the Caffeine app.

Additionally, the protocol used by apps to communicate with Internet Identity has been refactored and cleaned up.

What's Changed

• Rewrite communication transport implementation, split it from authorization by @sea-snake in #3612
• Implement certified attributes request handler. by @sea-snake in #3615
• Updated legacy redirect flow by @sea-snake in #3616

Full Changelog: release-2026-02-06...release-2026-02-10

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	e32532501b36e1a8cc850e3d6cfbe64627b137c6023351be7759fbf33493a31b
internet_identity_dev.wasm.gz	28b6edefe7f18598ba217dd58440aeee61e052f96e877ce038ee6472686be4ec
internet_identity_test.wasm.gz	080d73f67d09453bdd0fc380d1273fbabac68d4a4d9c3f7a231c0b12763a8468
archive.wasm.gz	c6ea52685f06d61994208b540272cf71d44a4d2be5396665ce8001983877f16c
vc_demo_issuer.wasm.gz	1b72e24d22c778f99a0296c0b0077da2ea887b1504f4a34cabeda05fe331f6ed

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout e1369f5b896540ed47b6e841ae9ac40c3a968716
./scripts/verify-hash --ii-hash e32532501b36e1a8cc850e3d6cfbe64627b137c6023351be7759fbf33493a31b

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.

release-2026-02-06: Redirect fixes, known passkey updates and ongoing work on attributes

This is Internet Identity release release-2026-02-06 for commit a51bc42342da9aca5792946383f6f8dcfe07c23b.
The sha256 of production asset internet_identity_production.wasm.gz is cf887e2c3cd33648b1319e89c8ead348b530b97224f6c46eaa174b3022b318db.

This release fixes redirects around legacy domains and updates the list of known passkeys. Additionally, it contains backend changes for an upcoming attribute certification feature that is not yet enabled for users.

What's Changed

• chore: Add CLI options to control which staging scripts/deploy-pr-to-beta deploys to by @aterga in #3603
• chore: Ensure only Staging A is used for release testing by @aterga in #3602
• Update Passkey AAGUID data by @pr-automation-bot-public[bot] in #3604
• Exclude authorize from redirect by @sea-snake in #3598
• feat: OpenID attribute certification by @aterga in #3600
• feat: Switch attribute values to blobs by @aterga in #3608
• fix: Ensure authn_method_session_register checks caller is self-authenticated by @aterga in #3605
• feat: More validation for OpenID credential issuers in attribute sharing by @aterga in #3606
• test: Add signature verification for II attributes by @aterga in #3611

Full Changelog: release-2026-01-31...release-2026-02-06

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	cf887e2c3cd33648b1319e89c8ead348b530b97224f6c46eaa174b3022b318db
internet_identity_dev.wasm.gz	b54127064a6792ee419bfe41c9909c370817d9e02768383028aefc39c16b1d67
internet_identity_test.wasm.gz	4f7d9dd756f7e02aacb9f170253618e4f703a6f96bf43ba76d2aa215d7e235be
archive.wasm.gz	c6ea52685f06d61994208b540272cf71d44a4d2be5396665ce8001983877f16c
vc_demo_issuer.wasm.gz	1b72e24d22c778f99a0296c0b0077da2ea887b1504f4a34cabeda05fe331f6ed

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout a51bc42342da9aca5792946383f6f8dcfe07c23b
./scripts/verify-hash --ii-hash cf887e2c3cd33648b1319e89c8ead348b530b97224f6c46eaa174b3022b318db --archive-hash c6ea52685f06d61994208b540272cf71d44a4d2be5396665ce8001983877f16c

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.

release-2026-01-31: Direct link to self-service from upgrade view

This is Internet Identity release release-2026-01-31 for commit f3eb12e94aec92083a26ebdaaeda5d720bb0923f.
The sha256 of production asset internet_identity_production.wasm.gz is 18acac29fbb6fe5641ab9df37224bedd9e1f93b4014394de65864f1bf6a79043.

This release is a correction of proposal/140185 (that referred to the wrong Wasm version due to a race condition in the GitHub release process). This proposal description is thus identical to proposal/140185 modulo this paragraph, the referenced Git commit, and the hashes of the Wasms being released. Kudos to Behrad for catching the issue!

This release adds a direct link to the self-service page (helpful for those upgrading to 2.0) and also includes and a few other, minor improvements.

What's Changed

• Exclude callback from redirect by @sea-snake in #3596
• Update Passkey AAGUID data by @pr-automation-bot-public[bot] in #3593
• Add additional authOrigin to NeuronPool entry. by @sea-snake in #3599
• Update upgrade modal footer to contain two links. by @sea-snake in #3601

Full Changelog: release-2026-01-26-v2...release-2026-01-31

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	18acac29fbb6fe5641ab9df37224bedd9e1f93b4014394de65864f1bf6a79043
internet_identity_dev.wasm.gz	bef45492d81575d2d50a53a60e2d5f99094a0fe3673f01a00ef6ee2b0506c54b
internet_identity_test.wasm.gz	1ea4c6a954be68d264faaaaa9cbf1f19f1c37232b096b19f3a87344ac31bb18c
archive.wasm.gz	ce746c2055fb6a0d6320535934cfccec6b47baef42e5c04f51742cf0fca95900
vc_demo_issuer.wasm.gz	f079d2118fc6932b2812f627f78841e3c1f4e850362a820716aa27792bf58f4d

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout f3eb12e94aec92083a26ebdaaeda5d720bb0923f
./scripts/verify-hash --ii-hash 18acac29fbb6fe5641ab9df37224bedd9e1f93b4014394de65864f1bf6a79043

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.

release-2026-01-26-v2: Switch identity.internetcomputer.org to new UX

This is Internet Identity release release-2026-01-26-v2 for commit 7c7913753a163d30dd657e3c6f7e50f292f12c1a.
The sha256 of production asset internet_identity_production.wasm.gz is 60e58d86adad45e3a475c1b518496d1f91819eb74a712debd565df4fca97bbe1.

This release also switches identity.internetcomputer.org to new UX.

What's Changed

• Switch identity.internetcomputer.org to new UX by @sea-snake in #3595

Full Changelog: release-2026-01-26...release-2026-01-26-v2

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	60e58d86adad45e3a475c1b518496d1f91819eb74a712debd565df4fca97bbe1
internet_identity_dev.wasm.gz	4cf076320ad3e87a0041212aae6d1de2a22927b4c829da472cbf507fefd30b61
internet_identity_test.wasm.gz	fd2c55e6c80993cd2c1beb4a1b697fdc9e1b775972a83476d706e420f4d38907
archive.wasm.gz	ce746c2055fb6a0d6320535934cfccec6b47baef42e5c04f51742cf0fca95900
vc_demo_issuer.wasm.gz	f079d2118fc6932b2812f627f78841e3c1f4e850362a820716aa27792bf58f4d

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout 7c7913753a163d30dd657e3c6f7e50f292f12c1a
./scripts/verify-hash --ii-hash 60e58d86adad45e3a475c1b518496d1f91819eb74a712debd565df4fca97bbe1

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.

release-2026-01-26: Hotfix passkey creation on legacy domains in Safari

This is Internet Identity release release-2026-01-26 for commit e869a131156105ab8217dd60c25ac28855bfbc14.
The sha256 of production asset internet_identity_production.wasm.gz is 6ca518484d9a71925ff1cb8f3053db964d02c43f04d84ead1bbbb96f8d5ffc86.

This hotfix release adds a fallback for cross-origin iframe passkeys on legacy domains, using related origins request instead in Safari since Safari doesn't support cross-origin passkey creation in iframes.

What's Changed

• Fall back to related origins request in Safari for cross-origin passkeys. by @sea-snake in #3594

Full Changelog: release-2026-01-22...release-2026-01-26

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	6ca518484d9a71925ff1cb8f3053db964d02c43f04d84ead1bbbb96f8d5ffc86
internet_identity_dev.wasm.gz	975ffb9ad9e1fe329ac08f6210b52543ac5c44290a084b26fbfe65a6b4252aa0
internet_identity_test.wasm.gz	3345a7a43896e3cf4cf078d9bf9067b11480709f4b801deddfa5abddd24e9034
archive.wasm.gz	ce746c2055fb6a0d6320535934cfccec6b47baef42e5c04f51742cf0fca95900
vc_demo_issuer.wasm.gz	f079d2118fc6932b2812f627f78841e3c1f4e850362a820716aa27792bf58f4d

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout e869a131156105ab8217dd60c25ac28855bfbc14
./scripts/verify-hash --ii-hash 6ca518484d9a71925ff1cb8f3053db964d02c43f04d84ead1bbbb96f8d5ffc86

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.

release-2026-01-22: Switch from legacy to new frontend

This is Internet Identity release release-2026-01-22 for commit ebce5eee7028958f61c283b2fdd6e8e026356704.
The sha256 of production asset internet_identity_production.wasm.gz is a7058d5030efe234fb99125ebfd6b725d2dbf14751ab73bdd74d8a807fcfc60c.

This release switches from the legacy to the new II frontend. To support users in upgrading their existing identities, the following measures are taken:

1. A self-service support page is added under /self-service, helping to recall one's legacy identity login number (which is needed for upgrading, but will be obsolete afterwards).
2. Double the maximum number of access methods to ensure users have enough head room for the passkey created during the upgrade process.
3. Enable the guided upgrade flow by default (so that no changes are required from app developers).
4. Allow upgrading using a recovery passkey.

The release also includes minor bug fixes.

What's Changed

• Update Passkey AAGUID data by @pr-automation-bot-public[bot] in #3585
• Self service page by @sea-snake in #3586
• Allow upgrading with any valid passkey (authentication or recovery). by @sea-snake in #3590
• feat: Double device limits by @aterga in #3588
• Switch identity.ic0.app to id.ai interface by @sea-snake in #3589
• Double passkeys limit in dashboard by @sea-snake in #3591

Full Changelog: release-2026-01-16...release-2026-01-22

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	a7058d5030efe234fb99125ebfd6b725d2dbf14751ab73bdd74d8a807fcfc60c
internet_identity_dev.wasm.gz	565d23dff750865f6395247a762c8c9a199995a34ed41e6bb148915ebe4f3642
internet_identity_test.wasm.gz	0f0fad929f1728dc2b82cfe020cf28fc8b4be11f30f956a94d7980ad9321231f
archive.wasm.gz	ce746c2055fb6a0d6320535934cfccec6b47baef42e5c04f51742cf0fca95900
vc_demo_issuer.wasm.gz	f079d2118fc6932b2812f627f78841e3c1f4e850362a820716aa27792bf58f4d

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout ebce5eee7028958f61c283b2fdd6e8e026356704
./scripts/verify-hash --ii-hash a7058d5030efe234fb99125ebfd6b725d2dbf14751ab73bdd74d8a807fcfc60c

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.

release-2026-01-16: Switch to unbounded anchor memory

This is Internet Identity release release-2026-01-16 for commit 1c93091cc6ce54925f942f2effb71b270f5d6db2.
The sha256 of production asset internet_identity_production.wasm.gz is f5eb8b7c6b691379b907f3324a4e47162b12cba3a979da8b5d31bd3e071a9420.

This release switches to unbounded anchor memory, lifting the 4KB-per-anchor restriction. This does not involve any visible change for end users.

Minor changes:

• Enable ii 2.0 (i.e., the UI used on id.ai) by default — this affect local testing.
• Update NFID logo

What's Changed

• Enable new interface by default by @sea-snake in #3575
• Update node version by @gix-bot in #3342
• chore: Update config for local testing with pulled DFX dependency by @aterga in #3576
• Update NFID logo by @sea-snake in #3583
• Simplify dfx pull args by @sea-snake in #3578
• chore: Switch to unbounded anchor memory by @aterga in #3571

Full Changelog: release-2026-01-13...release-2026-01-16

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	f5eb8b7c6b691379b907f3324a4e47162b12cba3a979da8b5d31bd3e071a9420
internet_identity_dev.wasm.gz	2c45c2aad6647f5bd9300dee7f6dd4eddf26ff9253cda4895a0aaa1b9e10ab43
internet_identity_test.wasm.gz	4db4e7174ae417582cc8dd67b909a85b8114c8621870b135bcecbf380c9e627c
archive.wasm.gz	ce746c2055fb6a0d6320535934cfccec6b47baef42e5c04f51742cf0fca95900
vc_demo_issuer.wasm.gz	f079d2118fc6932b2812f627f78841e3c1f4e850362a820716aa27792bf58f4d

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout 1c93091cc6ce54925f942f2effb71b270f5d6db2
./scripts/verify-hash --ii-hash f5eb8b7c6b691379b907f3324a4e47162b12cba3a979da8b5d31bd3e071a9420

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.